CVE-2024-3945: Delower WP To Do CSRF Vulnerability

CVE-2024-3945 Overview

CVE-2024-3945 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP To Do plugin for WordPress. All versions up to and including 1.3.0 are affected. The flaw stems from missing or incorrect nonce validation in the wptodo_manage() function. Unauthenticated attackers can add new todo items by tricking a site administrator into clicking a crafted link or visiting a malicious page. The issue is tracked under CWE-352 and was published to the National Vulnerability Database (NVD) on May 30, 2024.

Critical Impact
Unauthenticated attackers can forge administrator actions to inject todo items into affected WordPress sites, provided an administrator interacts with attacker-supplied content.

Affected Products

Delower WP To Do plugin for WordPress, versions up to and including 1.3.0
WordPress sites with the wp-todo plugin installed and activated
Administrator sessions accessing the WordPress dashboard while authenticated

Discovery Timeline

2024-05-30 - CVE-2024-3945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3945

Vulnerability Analysis

The WP To Do plugin exposes the wptodo_manage() function without proper Cross-Site Request Forgery protections. WordPress provides nonces as a standard mechanism to verify that state-changing requests originate from legitimate user interactions within the admin interface. The plugin either fails to generate a nonce or does not validate one before performing the todo management action. This allows any request reaching the endpoint from an authenticated administrator's browser to succeed, regardless of origin.

Root Cause

The root cause is the absence of a check_admin_referer() or wp_verify_nonce() call in the wptodo_manage() handler. Without a valid nonce check, the plugin cannot distinguish between requests initiated from the WordPress admin interface and requests forged by a third-party site. The affected code path is referenced in the plugin source at Model.php line 273.

Attack Vector

An attacker crafts a malicious HTML page or link containing a hidden form or image tag that submits a request to the vulnerable WordPress endpoint. The attacker then lures a logged-in administrator to visit the page through phishing or a link in a comment. The administrator's browser automatically sends session cookies with the forged request, and the plugin processes the action as if it were legitimate. The result is unauthorized creation of todo items under the administrator's identity. See the Wordfence Vulnerability Analysis for further technical detail.

Detection Methods for CVE-2024-3945

Indicators of Compromise

Unexpected new todo items appearing in the WP To Do plugin dashboard without corresponding administrator activity in access logs
HTTP POST or GET requests to WordPress admin endpoints with a Referer header pointing to an external, untrusted domain
Administrator sessions generating plugin write actions immediately after visiting external links from email or chat

Detection Strategies

Review web server access logs for requests to the WP To Do plugin management endpoint that lack an internal WordPress Referer header
Correlate WordPress user session activity with browser referrer data to identify state-changing requests originating outside the admin interface
Monitor plugin database tables for insertions that do not align with expected administrator workflow patterns

Monitoring Recommendations

Enable WordPress audit logging plugins to capture the origin, user agent, and timestamp of every plugin state change
Forward WordPress and web server logs to a centralized analytics platform for cross-source correlation
Alert on administrator accounts performing plugin actions from unfamiliar IP addresses or with suspicious referrer chains

How to Mitigate CVE-2024-3945

Immediate Actions Required

Update the WP To Do plugin to a version later than 1.3.0 once the vendor publishes a patched release
Deactivate and remove the WP To Do plugin if a patched version is not yet available and the functionality is not required
Instruct administrators to log out of WordPress before browsing untrusted sites or clicking external links

Patch Information

The vendor released a code update tracked in the WordPress Plugin Changeset. Administrators should upgrade to the fixed release through the WordPress plugin manager and verify the installed version reflects the patched build.

Workarounds

Restrict administrator dashboard access to a dedicated browser profile that is not used for general web browsing
Deploy a web application firewall rule that requires a valid Referer header matching the site's own domain for requests to plugin endpoints
Enforce SameSite cookie attributes on the WordPress session cookie to reduce cross-origin request success rates

bash

# Example WordPress configuration hardening in wp-config.php
define('COOKIE_DOMAIN', 'example.com');
@ini_set('session.cookie_samesite', 'Strict');