CVE-2024-37435: Perfect Portfolio CSRF Vulnerability

CVE-2024-37435 Overview

CVE-2024-37435 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Rarathemes Perfect Portfolio WordPress theme. The flaw exists in versions up to and including 1.2.0. An attacker can trick an authenticated user into submitting a crafted request that performs unintended state-changing actions within the theme's administrative functions. Successful exploitation requires user interaction, typically by luring an authenticated administrator to a malicious page. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Exploitation can result in unauthorized administrative actions in WordPress sites running Perfect Portfolio, with high impact to confidentiality, integrity, and availability when an authenticated user is socially engineered into executing the attacker's request.

Affected Products

Rarathemes Perfect Portfolio WordPress theme versions up to and including 1.2.0
WordPress sites with the perfect-portfolio theme active
Administrative sessions of users with privileged access to the theme's settings

Discovery Timeline

2025-01-02 - CVE-2024-37435 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-37435

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens in state-changing requests handled by the Perfect Portfolio theme. WordPress provides nonce mechanisms via wp_nonce_field() and check_admin_referer() to prevent forged requests. The affected theme code does not adequately enforce these checks on privileged actions. As a result, an attacker can craft an HTML form or image tag that triggers a request to a vulnerable endpoint using the victim's authenticated session.

Because the attack rides on the browser's automatic inclusion of session cookies, the malicious request appears legitimate to the WordPress backend. The impact escalates when the targeted user holds an administrator role, allowing modification of theme settings or related data without the user's intent.

Root Cause

The root cause is the absence of robust CSRF protections on one or more theme handlers that perform write operations. Without nonce validation tied to the user session, the server cannot distinguish legitimate administrator requests from cross-origin forged ones.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting form or scripted request targeting the vulnerable Perfect Portfolio endpoint. The attacker lures an authenticated WordPress user to the page through phishing or a malicious link. The victim's browser submits the request with valid session cookies, and the server executes the action. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-37435

Indicators of Compromise

Unexpected changes to Perfect Portfolio theme options or configuration timestamps that do not align with legitimate administrator activity
HTTP POST requests to theme admin endpoints with Referer headers from external domains
WordPress audit log entries showing setting modifications immediately following an administrator's visit to an untrusted external link

Detection Strategies

Inspect web server access logs for POST requests to /wp-admin/ endpoints associated with the perfect-portfolio theme that contain off-site or missing Referer headers
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to the theme lacking a valid WordPress nonce parameter
Correlate authentication events with administrative configuration changes to identify forged actions tied to user browsing sessions

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture theme setting changes and user-initiated actions
Forward WordPress and web server logs to a centralized SIEM for correlation across user sessions and HTTP requests
Alert on administrator account activity originating from atypical referrers or occurring outside of normal working hours

How to Mitigate CVE-2024-37435

Immediate Actions Required

Identify all WordPress installations running the Perfect Portfolio theme and verify the installed version against 1.2.0
Restrict administrator access to the WordPress dashboard via IP allowlisting or VPN until a patched version is applied
Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to use separate browsers or profiles for administrative tasks

Patch Information

At the time of publication, the vulnerability affects Perfect Portfolio versions up to and including 1.2.0. Site operators should consult the Patchstack Vulnerability Report and the vendor's update channels for a fixed release and apply it as soon as it becomes available.

Workarounds

Deploy a WAF rule that blocks requests to Perfect Portfolio admin endpoints when the Referer header is missing or does not match the site's origin
Enforce the SameSite=Lax or SameSite=Strict attribute on WordPress authentication cookies to limit cross-origin cookie transmission
Disable or remove the Perfect Portfolio theme on sites where it is not actively required until a patched version is installed

bash

# Example Nginx configuration to enforce Referer validation on theme admin endpoints
location ~* /wp-admin/admin\.php {
    if ($http_referer !~* ^https?://your-site\.example/) {
        return 403;
    }
}