CVE-2024-43287: Sendinblue Newsletter CSRF Vulnerability

CVE-2024-43287 Overview

CVE-2024-43287 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms plugin for WordPress. The flaw exists in all versions up to and including 3.1.82. An attacker can trick an authenticated administrator into submitting forged requests that perform unintended actions on the plugin. The issue is tracked under CWE-352 and carries a CVSS 3.1 base score of 8.8.

Critical Impact
Successful exploitation requires only that a logged-in administrator visit an attacker-controlled page, allowing the attacker to compromise confidentiality, integrity, and availability of the affected WordPress site.

Affected Products

Brevo (Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin
All plugin versions from n/a through 3.1.82
WordPress sites with the plugin installed and an authenticated administrator session

Discovery Timeline

2024-08-26 - CVE-2024-43287 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43287

Vulnerability Analysis

The plugin exposes state-changing actions without enforcing anti-CSRF token validation. WordPress plugins are expected to validate requests using nonces generated by wp_create_nonce() and verified through check_admin_referer() or wp_verify_nonce(). When these checks are absent or improperly implemented, a forged HTTP request originating from an attacker-controlled origin executes with the privileges of the victim session.

The vulnerability requires user interaction. An administrator must visit a malicious page or click a crafted link while authenticated to the WordPress dashboard. The browser then submits the forged request with valid session cookies, and the plugin processes it as legitimate. Refer to the Patchstack Vulnerability Analysis for additional technical context.

Root Cause

The plugin handlers for administrative actions do not validate a CSRF token before processing requests. The omission of nonce verification in privileged endpoints allows any same-session request to alter plugin configuration or trigger backend operations. CWE-352 categorizes this as a failure to ensure that requests are intentionally submitted by the authenticated user.

Attack Vector

The attack vector is network-based and exploitable without authentication on the attacker side. The attacker crafts an HTML page containing a hidden form or auto-submitting JavaScript that targets a vulnerable plugin endpoint. When a logged-in WordPress administrator loads the page, the browser issues the request using their session cookies, and the plugin executes the action. Chaining this primitive with stored configuration changes can lead to persistent compromise of the WordPress installation.

Detection Methods for CVE-2024-43287

Indicators of Compromise

Unexpected modifications to Brevo plugin settings, API keys, or subscriber lists in the WordPress admin
Outbound HTTP referrers from external domains preceding administrative POST requests to plugin endpoints
New or modified subscribe forms, SMTP credentials, or transactional email configurations without a corresponding admin change ticket
WordPress audit log entries showing privileged actions originating from administrator sessions with cross-origin referrers

Detection Strategies

Inspect web server access logs for POST requests to plugin admin endpoints under /wp-admin/admin.php?page= paths with Referer headers pointing to untrusted external domains
Deploy a Web Application Firewall (WAF) rule to flag state-changing requests to the plugin without a valid WordPress nonce parameter
Correlate authentication events with subsequent configuration changes to identify session-riding patterns

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture all administrative configuration changes with source IP and referrer
Forward WordPress and reverse proxy logs to a centralized SIEM for cross-origin request analysis
Alert on any administrator-initiated request whose Origin or Referer header does not match the WordPress site domain

How to Mitigate CVE-2024-43287

Immediate Actions Required

Update the Brevo plugin to a version newer than 3.1.82 as soon as the vendor publishes a fixed release
Audit recent administrative actions and plugin settings for unauthorized changes, including SMTP and API credentials
Rotate Brevo API keys and WordPress administrator passwords if compromise is suspected
Restrict WordPress administrator accounts to dedicated browser profiles that do not browse untrusted sites

Patch Information

Review the Patchstack Vulnerability Analysis for the current patched version and vendor remediation guidance. Apply the update through the WordPress plugin manager and verify the installed version against the advisory.

Workarounds

Disable the Brevo plugin until a patched version is installed if administrators cannot avoid browsing external sites in the same session
Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress authentication cookies via server configuration
Deploy a WAF rule that blocks cross-origin POST requests to /wp-admin/ endpoints missing a valid _wpnonce parameter
Require re-authentication for sensitive admin actions using a plugin that adds two-factor confirmation to configuration changes

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to wp-admin without a nonce
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1004324,msg:'Possible CSRF against WordPress admin'"
SecRule REQUEST_URI "@beginsWith /wp-admin/" \
  "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" \
  "chain"
SecRule ARGS:_wpnonce "@rx ^$"