CVE-2024-38724: Contact Form 7 Summary CSRF/XSS Flaw

CVE-2024-38724 Overview

CVE-2024-38724 is a stored Cross-Site Scripting (XSS) vulnerability chained with Cross-Site Request Forgery (CSRF) in the Contact Form 7 Summary and Print plugin for WordPress. The plugin, developed by Muhammad Rehman, is affected in all versions up to and including 1.2.5. An attacker can trick an authenticated administrator into submitting a forged request that injects persistent JavaScript into the plugin's stored data. The injected payload executes in the browser of any user who later views the affected page, enabling session hijacking, administrative action abuse, and further compromise of the WordPress site.

Critical Impact
Successful exploitation results in stored JavaScript execution in administrator browsers, with potential for account takeover and lateral movement within the WordPress instance.

Affected Products

Muhammad Rehman Contact Form 7 Summary and Print plugin for WordPress
All versions from n/a through 1.2.5
WordPress sites running the vulnerable plugin with authenticated administrators

Discovery Timeline

2024-08-13 - CVE-2024-38724 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-38724

Vulnerability Analysis

The vulnerability combines two distinct weaknesses to achieve stored script execution. The plugin's administrative endpoints lack anti-CSRF token validation, allowing external sites to forge state-changing requests on behalf of authenticated administrators. The same endpoints fail to sanitize or encode user-supplied input before persisting it to the database and rendering it back into HTML pages. This pairing is classified under [CWE-79] for Improper Neutralization of Input During Web Page Generation.

An attacker hosts a malicious page containing a crafted form or fetch request targeting the plugin's settings or data submission endpoint. When a logged-in WordPress administrator visits the attacker-controlled page, the browser automatically attaches authentication cookies to the forged request. The plugin processes the request and stores the attacker's JavaScript payload. Any subsequent page rendering this data executes the script in the victim's browser context.

Root Cause

The root cause is the absence of two complementary controls: WordPress nonce verification (wp_verify_nonce) on form submission handlers and output encoding (esc_html, esc_attr) when rendering stored content. Either control alone would mitigate the chain, but the plugin omits both.

Attack Vector

Exploitation requires network access to the WordPress site and user interaction from a privileged user. The attacker must lure an authenticated administrator to a malicious URL or page during an active session. The scope is changed because injected scripts execute in a security context different from the plugin's own.

The vulnerability manifests in the plugin's settings and data persistence handlers. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-38724

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes within plugin-managed records stored in the wp_options or plugin-specific database tables
WordPress administrator sessions originating from unusual referrers immediately before configuration changes
New or modified administrator accounts created without corresponding audit log entries from known admins
Outbound requests from administrator browsers to unfamiliar domains after visiting the WordPress admin panel

Detection Strategies

Review plugin-related database entries for HTML or JavaScript content that should be plain text
Monitor web server access logs for POST requests to plugin endpoints lacking a same-origin Referer header
Inspect rendered admin pages for unexpected inline scripts using Content Security Policy (CSP) violation reports

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration changes and the originating user and IP
Forward web server and WordPress logs to a centralized analytics platform for correlation across sessions
Alert on anomalous administrator behavior such as configuration edits immediately following external page visits

How to Mitigate CVE-2024-38724

Immediate Actions Required

Update the Contact Form 7 Summary and Print plugin to a version later than 1.2.5 once the vendor releases a patched build
Deactivate and remove the plugin if a fixed version is not yet available and the functionality is non-essential
Force-reset administrator passwords and invalidate active WordPress sessions if exploitation is suspected
Audit existing plugin records for stored HTML or JavaScript content and remove malicious entries

Patch Information

The Patchstack advisory tracks the vulnerable version range through 1.2.5. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed release.

Workarounds

Restrict access to /wp-admin/ by IP allowlist to reduce CSRF exposure from external networks
Deploy a Web Application Firewall (WAF) rule that blocks requests to plugin endpoints missing valid WordPress nonces
Enforce a strict Content Security Policy that disallows inline scripts on administrative pages
Require administrators to log out of WordPress before browsing untrusted sites and use separate browser profiles for admin work

bash

# Example WAF rule (ModSecurity) blocking plugin POST requests without a same-site Referer
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1003824,phase:1,deny,status:403,msg:'CVE-2024-38724 CSRF protection'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain"
    SecRule ARGS:page "@contains cf7-summary" \
      "chain"
      SecRule &REQUEST_HEADERS:Referer "@eq 0"