CVE-2024-37238: WPAdverts CSRF Vulnerability

CVE-2024-37238 Overview

CVE-2024-37238 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WPAdverts classifieds plugin for WordPress, developed by Greg Winiarski. The flaw affects all versions up to and including 2.1.2. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unintended state-changing requests against the WPAdverts plugin. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, such as clicking a link or loading an attacker-controlled page, but does not require prior authentication credentials from the attacker.

Critical Impact
Successful exploitation allows attackers to perform unauthorized state changes within WPAdverts by abusing an authenticated user's session, resulting in limited integrity impact on affected WordPress sites.

Affected Products

Greg Winiarski WPAdverts (WordPress Classifieds Plugin)
All versions from initial release through 2.1.2
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2025-01-02 - CVE-2024-37238 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37238

Vulnerability Analysis

The vulnerability resides in the WPAdverts plugin's handling of state-changing HTTP requests. The plugin fails to properly validate anti-CSRF tokens (nonces) on one or more sensitive request handlers. As a result, an attacker can construct HTML or JavaScript payloads on an external site that submit forged requests to a target WordPress instance running WPAdverts.

When an authenticated user, particularly an administrator or privileged editor, visits the attacker-controlled page, the browser transmits the request along with valid session cookies. The plugin processes the request as legitimate. This produces unauthorized modifications within the plugin's scope, without the victim's knowledge or consent.

Root Cause

The root cause is the absence or improper verification of WordPress nonces (wp_nonce_field and check_admin_referer / wp_verify_nonce) on privileged actions exposed by the WPAdverts plugin. WordPress provides a standard nonce framework specifically to defend against CSRF, but the affected code paths do not enforce these checks correctly through version 2.1.2.

Attack Vector

Exploitation follows a standard CSRF pattern. The attacker hosts a malicious page containing an auto-submitting form or an image tag targeting a WPAdverts endpoint. The attacker then lures an authenticated WordPress user to visit the page through phishing, forum posts, or malicious advertising. The victim's browser automatically attaches session cookies, and the target site executes the forged action.

The attack requires the victim to be logged in to the vulnerable WordPress site at the time of visiting the malicious page. No attacker credentials are required. Refer to the Patchstack CSRF Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-37238

Indicators of Compromise

Unexpected changes to WPAdverts settings, listings, or configuration made without corresponding admin activity in audit logs
HTTP POST or GET requests to WPAdverts admin endpoints with Referer headers pointing to external, untrusted domains
Authenticated WordPress sessions generating requests immediately after visiting third-party sites in browser history
Absence of a valid _wpnonce parameter on state-changing requests to WPAdverts handlers

Detection Strategies

Inspect WordPress access logs for state-changing requests to /wp-admin/admin.php or /wp-admin/admin-ajax.php with WPAdverts-related action parameters and missing or invalid nonce values
Correlate administrative changes in the WPAdverts plugin with the originating user session and Referer header
Monitor for anomalous request patterns from privileged accounts originating cross-origin

Monitoring Recommendations

Enable detailed WordPress audit logging using a security plugin to capture plugin configuration changes and the initiating user
Forward web server access logs to a centralized log analytics platform for correlation and alerting on suspicious Referer values
Alert on privileged WordPress accounts performing WPAdverts administrative actions outside expected working hours or from unusual client fingerprints

How to Mitigate CVE-2024-37238

Immediate Actions Required

Upgrade the WPAdverts plugin to a version later than 2.1.2 that contains the CSRF fix
Audit WPAdverts configuration, listings, and user permissions for unauthorized changes since the vulnerable version was installed
Instruct WordPress administrators to log out of the admin panel when not actively performing management tasks
Review WordPress user accounts and revoke unnecessary administrator privileges

Patch Information

Refer to the Patchstack CSRF Vulnerability Advisory for vendor-supplied patch details. Update the plugin through the WordPress plugin dashboard once a fixed release is confirmed by the vendor.

Workarounds

Deactivate the WPAdverts plugin until the site can be updated to a patched release
Deploy a web application firewall rule that blocks cross-origin POST requests to WPAdverts admin endpoints lacking a valid _wpnonce
Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce cross-site request feasibility
Restrict access to /wp-admin/ by IP allowlist where operationally feasible

bash

# Example nginx rule to block cross-origin POSTs to WPAdverts admin endpoints
location ~ ^/wp-admin/admin(-ajax)?\.php$ {
    if ($request_method = POST) {
        set $block "";
        if ($http_referer !~* "^https?://your-domain\.com/") { set $block "1"; }
        if ($arg_action ~* "wpadverts") { set $block "${block}1"; }
        if ($block = "11") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}