CVE-2024-37412: Blossom Shop CSRF Vulnerability

CVE-2024-37412 Overview

CVE-2024-37412 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Blossom Shop WordPress theme developed by blossomthemes. The flaw exists in all versions up to and including 1.1.7. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions in the WordPress site. The vulnerability is classified under [CWE-352] and carries a network attack vector requiring user interaction. Successful exploitation can lead to compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Critical Impact
Attackers can trick authenticated administrators into performing unintended state-changing actions on Blossom Shop installations, potentially leading to site compromise.

Affected Products

blossomthemes Blossom Shop WordPress theme versions up to and including 1.1.7
WordPress sites with the blossom-shop theme active
E-commerce sites built on the affected theme

Discovery Timeline

2025-01-02 - CVE-2024-37412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37412

Vulnerability Analysis

The vulnerability stems from missing or improper CSRF protections in the Blossom Shop theme. WordPress provides nonce tokens through functions like wp_nonce_field() and check_admin_referer() to validate request origin. The affected theme fails to apply these protections on sensitive endpoints. An attacker hosts a crafted page containing forged requests targeting the WordPress admin handlers. When an authenticated administrator visits the page, the browser submits the request with valid session cookies. The server processes the action because no origin verification occurs.

Root Cause

The root cause is the absence of anti-CSRF tokens on administrative actions exposed by the blossom-shop theme. Without nonce validation, the application cannot distinguish between intentional administrator requests and requests forged by a third-party site. This is a textbook [CWE-352] weakness.

Attack Vector

Exploitation requires an authenticated user, typically with administrative privileges, to interact with attacker-controlled content. The attacker delivers a malicious link or embeds a forged form on a controlled domain. Upon visit, the victim's browser silently issues the request to the WordPress site. Because the request carries the victim's authentication cookies, the application accepts it as legitimate.

No verified public exploit code is available for this issue. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-37412

Indicators of Compromise

Unexpected configuration or content changes within the WordPress admin associated with the Blossom Shop theme
HTTP POST requests to theme administrative endpoints with Referer headers pointing to external untrusted domains
Administrator session activity originating immediately after visits to unfamiliar third-party URLs

Detection Strategies

Review web server access logs for state-changing requests to theme endpoints lacking valid WordPress nonce parameters such as _wpnonce
Correlate administrator browsing history with subsequent administrative actions to detect cross-origin trigger patterns
Monitor for new or modified options, posts, or user roles immediately following external referrer activity

Monitoring Recommendations

Enable WordPress audit logging plugins to record administrative actions with source IP and referrer information
Forward web access and application logs to a centralized SIEM for correlation and retention
Configure alerts on administrative POST requests originating from cross-origin referrers

How to Mitigate CVE-2024-37412

Immediate Actions Required

Identify all WordPress sites running the Blossom Shop theme at version 1.1.7 or earlier
Restrict administrative access to trusted IP ranges where feasible
Instruct administrators to log out of WordPress before browsing untrusted sites

Patch Information

No fixed version is identified in the available advisory data. Site operators should monitor the Patchstack Vulnerability Report and the vendor's release channels for an updated theme version that introduces nonce validation on affected endpoints.

Workarounds

Deploy a Web Application Firewall (WAF) with rules that validate the Referer and Origin headers on administrative requests
Use a virtual patching solution such as a WordPress security plugin that enforces nonce checks on theme endpoints
Consider switching to an alternative maintained e-commerce theme if a vendor patch is not released in a timely manner

bash

# Example WAF rule concept - block admin POSTs with external referrers
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1000001,msg:'Blossom Shop CSRF mitigation'"
  SecRule REQUEST_URI "@contains /wp-admin/" "chain"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"