CVE-2024-37450: Rarathemes Benevolent CSRF Vulnerability

CVE-2024-37450 Overview

CVE-2024-37450 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Rarathemes Benevolent WordPress theme. The flaw affects all versions up to and including 1.3.4. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions in the WordPress site.

The vulnerability requires user interaction and exploits the trust the application places in the authenticated browser session. Successful exploitation can compromise confidentiality, integrity, and availability of the affected site.

Critical Impact
An authenticated administrator visiting an attacker-controlled page can have privileged actions executed on the Benevolent-powered WordPress site without consent.

Affected Products

Rarathemes Benevolent WordPress theme versions up to and including 1.3.4
WordPress installations using the Benevolent theme
Sites where administrators access untrusted content while authenticated

Discovery Timeline

2025-01-02 - CVE-2024-37450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37450

Vulnerability Analysis

The Benevolent theme exposes one or more state-changing endpoints that do not validate a per-request anti-CSRF token. When a logged-in WordPress administrator loads attacker-controlled HTML or JavaScript, the browser automatically attaches the session cookie to forged requests aimed at the vulnerable theme endpoint. The server processes the request as if it originated from the authenticated user.

Because the affected actions are administrative, exploitation can lead to configuration changes, content manipulation, or settings modifications. The attack vector is network-based, complexity is low, and no prior privileges are required from the attacker. User interaction is required from the victim.

Root Cause

The root cause is missing or improperly verified CSRF protection on sensitive theme handlers. WordPress provides wp_nonce_field() and check_admin_referer() to mitigate CSRF, but the affected Benevolent code paths fail to enforce nonce validation before performing privileged operations.

Attack Vector

An attacker hosts a page containing a hidden form or JavaScript that auto-submits a request to the vulnerable Benevolent endpoint on the target site. The attacker lures an authenticated administrator to visit the page through phishing, a malicious link, or a compromised third-party site. The victim's browser submits the forged request with valid session cookies, and the server executes the action under the administrator's identity.

No verified exploit code or public proof-of-concept is currently available. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-37450

Indicators of Compromise

Unexpected modifications to theme settings, widgets, or site customizer options without a corresponding administrator action in the audit log
HTTP POST requests to Benevolent theme endpoints with a Referer header pointing to an external or unrelated domain
Administrator sessions performing privileged actions immediately after visiting an unfamiliar external URL

Detection Strategies

Inspect WordPress access logs for state-changing requests to Benevolent theme handlers that lack a valid _wpnonce parameter
Correlate administrator authentication events with subsequent configuration changes to identify forged requests
Monitor for outbound clicks from administrator workstations to suspicious domains followed by site modifications

Monitoring Recommendations

Enable WordPress activity logging plugins to record administrative actions with source IP and referer details
Forward web server and WordPress audit logs to a centralized SIEM for cross-referencing with endpoint browsing telemetry
Alert on administrator account activity originating from atypical referers or unusual user-agent strings

How to Mitigate CVE-2024-37450

Immediate Actions Required

Upgrade the Benevolent theme to a version later than 1.3.4 once the vendor publishes a patched release
Restrict administrator browsing on the same session used to manage the WordPress site
Review recent theme configuration changes and revert any unauthorized modifications

Patch Information

No fixed version is identified in the available CVE data. Site operators should monitor the Patchstack Vulnerability Report and the Rarathemes vendor channels for the release of an updated theme version that adds nonce validation to the affected endpoints.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks POST requests to Benevolent theme endpoints lacking a valid _wpnonce parameter or with an external Referer
Enforce the SameSite=Lax or SameSite=Strict attribute on the WordPress authentication cookie to limit cross-site cookie transmission
Require administrators to use a dedicated browser profile or session that is not used for general web browsing
Disable or replace the Benevolent theme until a patched version is available

bash

# Example WAF rule (ModSecurity) blocking unauthenticated cross-origin POSTs
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1003745,phase:1,deny,status:403,msg:'CVE-2024-37450 CSRF block'"
  SecRule REQUEST_URI "@contains /wp-admin/" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"