CVE-2024-35772: Presscustomizr Hueman CSRF Vulnerability

CVE-2024-35772 Overview

CVE-2024-35772 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Presscustomizr Hueman WordPress theme. The flaw impacts all versions of Hueman from initial release through version 3.7.24. The vulnerability is classified under CWE-352 and stems from missing or insufficient CSRF token validation on state-changing requests handled by the theme.

An attacker can craft a malicious web page that triggers unauthorized actions when a logged-in WordPress administrator visits it. Successful exploitation requires user interaction but no authentication on the attacker side.

Critical Impact
An attacker can perform privileged actions on a vulnerable WordPress site by tricking an authenticated administrator into visiting a malicious page, leading to confidentiality, integrity, and availability impact.

Affected Products

Presscustomizr Hueman WordPress theme versions up to and including 3.7.24
WordPress sites with the vulnerable theme installed and active
WordPress administrators with active sessions who visit attacker-controlled pages

Discovery Timeline

2024-06-21 - CVE-2024-35772 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-35772

Vulnerability Analysis

The Hueman theme exposes one or more administrative actions that do not properly verify the origin of incoming requests. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, and wp_verify_nonce) to prevent CSRF on privileged endpoints. When these checks are missing or implemented incorrectly, any request submitted by an authenticated user's browser is treated as legitimate.

An attacker who knows the target endpoint can host a page containing an auto-submitting HTML form or JavaScript fetch call. When an authenticated administrator visits that page, the browser attaches the WordPress session cookie to the cross-origin request, and the vulnerable handler executes the action under the administrator's privileges.

The vulnerability affects network-reachable WordPress installations and requires user interaction by an authenticated user, which is consistent with classic CSRF exploitation patterns.

Root Cause

The root cause is missing or inadequate CSRF protection on theme functionality that performs state-changing operations. The theme code does not validate a WordPress nonce or verify the HTTP Referer and Origin headers before executing the requested action.

Attack Vector

Exploitation occurs over the network through a victim's browser. The attacker delivers a link or embedded resource by phishing, malicious advertising, or compromised third-party sites. When the authenticated WordPress administrator loads the attacker-controlled content, the browser issues a forged request to the vulnerable theme endpoint and the action completes silently. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-35772

Indicators of Compromise

Unexpected configuration changes to the Hueman theme settings without corresponding administrator activity in audit logs
HTTP POST requests to WordPress admin endpoints carrying a cross-origin Referer header or no Referer at all
New or modified theme options, widget configurations, or customizer settings appearing outside normal change windows

Detection Strategies

Review WordPress access logs for POST requests to wp-admin endpoints associated with the Hueman theme that originate from external referrers
Enable WordPress audit logging plugins to capture theme option changes and correlate them with administrator session activity
Inspect web server logs for requests missing valid WordPress nonce parameters on state-changing actions

Monitoring Recommendations

Monitor for anomalous changes to theme settings and customizer options on production WordPress sites
Alert on administrator account activity that occurs immediately after the user browses external sites or clicks email links
Track installation and version inventory of WordPress themes to identify hosts still running Hueman 3.7.24 or earlier

How to Mitigate CVE-2024-35772

Immediate Actions Required

Update the Hueman theme to a version later than 3.7.24 as soon as a fixed release is available from Presscustomizr
Audit recent administrator activity and theme configuration for unauthorized changes
Force re-authentication of all WordPress administrator sessions to invalidate any session that may have been abused

Patch Information

No vendor patch URL is listed in the NVD record at the time of publication. Site operators should consult the Patchstack Vulnerability Report and the official Presscustomizr Hueman changelog for the patched release.

Workarounds

Deactivate the Hueman theme on production sites until a patched version is installed and switch to a maintained alternative
Restrict WordPress administrator access to dedicated browsers or browser profiles that are not used for general web browsing
Deploy a web application firewall rule that requires a same-origin Referer or Origin header on POST requests to WordPress admin endpoints

bash

# Example WAF rule concept: block cross-origin POSTs to wp-admin
# (ModSecurity-style pseudo-rule)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1000352,msg:'Cross-origin POST to wp-admin blocked'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" "chain"
    SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example"