CVE-2024-3947: Delower WP To Do CSRF Vulnerability

CVE-2024-3947 Overview

CVE-2024-3947 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the WP To Do plugin for WordPress. The flaw exists in all versions up to and including 1.3.0 and stems from missing or incorrect nonce validation on the wptodo_settings() function. An unauthenticated attacker can forge a request that modifies the plugin's settings if a site administrator can be tricked into clicking a crafted link or visiting an attacker-controlled page. Exploitation requires user interaction but no authentication on the attacker side.

Critical Impact
Unauthenticated attackers can modify WP To Do plugin settings on affected WordPress sites by tricking an administrator into clicking a malicious link.

Affected Products

Delower WP To Do plugin for WordPress
All versions up to and including 1.3.0
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-05-30 - CVE-2024-3947 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3947

Vulnerability Analysis

The vulnerability resides in the wptodo_settings() function within the plugin's settings handling logic. WordPress plugins are expected to use nonces to validate the authenticity of state-changing requests. The WP To Do plugin either omits this nonce check entirely or implements it incorrectly, which allows externally originated requests to be accepted as if they came from the administrator's own session.

Because the vulnerable action modifies plugin settings rather than executing code or exposing sensitive data, the direct impact is limited to integrity of plugin configuration. However, altered settings can serve as a stepping stone for broader attacks against the WordPress site, depending on how the plugin consumes those settings.

Root Cause

The root cause is missing or improper nonce verification [CWE-352] on the settings-update code path. WordPress provides wp_verify_nonce() and check_admin_referer() helpers specifically to defend against CSRF, and the vulnerable handler does not enforce them before applying submitted changes.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a malicious page or crafts a link that submits a forged request to the target WordPress site. When an authenticated administrator visits the page or clicks the link, the browser automatically includes their session cookies, causing the vulnerable endpoint to process the request as legitimate. See the Wordfence Vulnerability Report and the WordPress Plugin Model Code for the vulnerable function reference.

No public proof-of-concept exploit code is listed in the enriched data, so no exploitation code is reproduced here.

Detection Methods for CVE-2024-3947

Indicators of Compromise

Unexpected changes to WP To Do plugin settings in the WordPress administrative interface.
Administrator-originated POST requests to the plugin settings endpoint containing a Referer header pointing to an external, untrusted domain.
Entries in web server access logs showing settings-modification requests immediately after an administrator loaded an external URL.

Detection Strategies

Inventory WordPress deployments and flag any installation running WP To Do version 1.3.0 or earlier.
Review WordPress audit logs (via a logging plugin) for plugin settings changes correlated with administrator browsing activity.
Inspect HTTP request logs for settings-update requests that lack a valid WordPress nonce parameter.

Monitoring Recommendations

Enable administrative action auditing on all WordPress sites and ship logs to a centralized analytics or SIEM platform for correlation.
Alert on configuration changes to installed plugins outside of approved change windows.
Monitor administrator accounts for anomalous referrer patterns that could indicate CSRF delivery.

How to Mitigate CVE-2024-3947

Immediate Actions Required

Update the WP To Do plugin to a version later than 1.3.0 once a fixed release is available from the vendor.
If no patched version is available, deactivate and remove the WP To Do plugin from affected WordPress sites.
Instruct WordPress administrators to log out of the admin console when not actively managing the site.

Patch Information

The vendor committed a code change tracked in the WordPress Plugin Changeset referenced in the advisory. Administrators should install the latest version of the plugin from the WordPress plugin repository and confirm the installed version is higher than 1.3.0.

Workarounds

Restrict access to the WordPress /wp-admin/ path by source IP address using the web server or a web application firewall.
Deploy a WordPress security plugin or WAF ruleset that enforces nonce validation and blocks cross-origin POST requests to plugin settings endpoints.
Require administrators to use a dedicated browser profile for WordPress administration to reduce exposure to CSRF payloads hosted on other sites.

bash

# Example: block cross-origin POSTs to the WP To Do settings endpoint in nginx
location ~ ^/wp-admin/admin\.php$ {
    if ($request_method = POST) {
        set $csrf_block 0;
        if ($http_referer !~* "^https?://your-wordpress-domain\.tld/") { set $csrf_block 1; }
        if ($csrf_block = 1) { return 403; }
    }
}