CVE-2024-37237: FS Poster CSRF Vulnerability

CVE-2024-37237 Overview

CVE-2024-37237 is a Cross-Site Request Forgery (CSRF) vulnerability in the FS Poster plugin by fs-code for WordPress. The flaw affects all plugin versions up to and including 6.5.8. An attacker can trick an authenticated user into submitting a forged request that performs unintended actions within the plugin. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed. Exploitation is network-based and does not require prior authentication by the attacker.

Critical Impact
Successful exploitation can allow attackers to modify plugin state or trigger unauthorized posting actions on behalf of an authenticated WordPress user.

Affected Products

fs-code FS Poster WordPress plugin
All versions up to and including 6.5.8
WordPress sites using the FS Poster social media auto-poster plugin

Discovery Timeline

2025-01-02 - CVE-2024-37237 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37237

Vulnerability Analysis

The FS Poster plugin fails to enforce proper anti-CSRF protections on one or more state-changing endpoints. An attacker who lures an authenticated WordPress user to a malicious page can force the browser to issue a request to the vulnerable endpoint. The victim's active session cookies authenticate the request, allowing the attacker to perform actions the user is authorized to execute.

The impact is limited to integrity of plugin state. Confidentiality and availability are not affected according to the CVSS vector. Exploitation requires the victim to interact with attacker-controlled content such as clicking a link or visiting a crafted page.

Root Cause

The root cause is missing or insufficient validation of request origin, typically absent or improperly verified WordPress nonces on plugin action handlers. Without a valid nonce check using functions such as wp_verify_nonce() or check_admin_referer(), the plugin cannot distinguish between legitimate user-initiated requests and forged cross-origin requests.

Attack Vector

An attacker crafts a malicious HTML page containing a form or JavaScript that auto-submits a request to the vulnerable FS Poster endpoint. When an authenticated WordPress administrator or editor visits the page, the browser sends the request with valid session cookies. The plugin processes the action as if it originated from the legitimate user. See the Patchstack advisory for FS Poster for additional technical context.

No verified public proof-of-concept code is available for this issue.

Detection Methods for CVE-2024-37237

Indicators of Compromise

Unexpected posts, drafts, or social media publications initiated through the FS Poster plugin
HTTP POST requests to FS Poster admin endpoints originating from external Referer headers
WordPress audit log entries showing plugin configuration changes without corresponding administrator activity

Detection Strategies

Review web server access logs for requests to wp-admin/admin.php or admin-ajax.php targeting FS Poster actions with off-site referrers
Monitor WordPress activity logs for FS Poster configuration or posting actions that do not correlate with legitimate administrator sessions
Inspect browser telemetry or WAF logs for cross-origin form submissions targeting FS Poster endpoints

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule to flag POST requests to FS Poster endpoints missing valid WordPress nonce parameters
Enable WordPress security plugin audit logging to capture all administrative actions with source IP and referer metadata
Alert on abnormal spikes in social media posting volume driven by the FS Poster plugin

How to Mitigate CVE-2024-37237

Immediate Actions Required

Update the FS Poster plugin to a version newer than 6.5.8 as soon as a patched release is available from the vendor
Restrict WordPress administrator and editor accounts to trusted users only, and enforce least-privilege role assignments
Instruct privileged users to log out of WordPress sessions before browsing untrusted websites

Patch Information

Refer to the Patchstack advisory for FS Poster for the vendor's fixed version and upgrade guidance. Site administrators should verify the plugin version in the WordPress dashboard under Plugins and apply the update through the standard update mechanism.

Workarounds

Deactivate the FS Poster plugin until a patched version is installed if the plugin is not business-critical
Deploy a WAF signature that blocks requests to FS Poster endpoints lacking a valid _wpnonce parameter
Enforce SameSite=Lax or SameSite=Strict cookie policies on WordPress session cookies to reduce CSRF exposure

bash

# Example: verify installed FS Poster version via WP-CLI
wp plugin get fs-poster --field=version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate fs-poster