CVE-2024-43338 Overview
CVE-2024-43338 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Automattic Crowdsignal Dashboard – Polls, Surveys & more WordPress plugin (also known as polldaddy). The flaw exists in all versions up to and including 3.1.3. The vulnerability is classified under CWE-352 and stems from missing or insufficient anti-CSRF token validation on state-changing requests.
An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unintended actions in the plugin context. Exploitation requires user interaction, and the impact is limited to integrity of plugin-managed data.
Critical Impact
Authenticated WordPress users can be tricked into performing unintended state-changing actions in the Crowdsignal Dashboard plugin, resulting in unauthorized modification of plugin data.
Affected Products
- Automattic Crowdsignal Dashboard – Polls, Surveys & more (polldaddy)
- All versions from n/a through <= 3.1.3
- WordPress sites running the affected plugin versions
Discovery Timeline
- 2024-11-19 - CVE-2024-43338 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43338
Vulnerability Analysis
CVE-2024-43338 is a Cross-Site Request Forgery weakness in the Crowdsignal Dashboard WordPress plugin. The plugin exposes one or more state-changing endpoints that do not properly verify the origin or authenticity of incoming requests. As a result, requests initiated from third-party origins are processed as if they came from a legitimate user session.
Exploitation requires an authenticated WordPress user (typically an administrator or editor with plugin access) to visit an attacker-controlled page. The browser automatically attaches the user's WordPress session cookies to the forged request, and the plugin performs the requested action.
The impact is bounded to integrity of data managed by the plugin, such as poll or survey configuration entries. Confidentiality and availability are not directly affected according to the published vector.
Root Cause
The root cause is missing or inadequate CSRF protection on plugin request handlers. WordPress provides nonces via wp_nonce_field() and check_admin_referer() / wp_verify_nonce() for exactly this purpose. Where these checks are absent or improperly validated, state-changing actions can be triggered cross-origin.
Attack Vector
An attacker hosts a page containing an auto-submitting HTML form or JavaScript that targets a vulnerable plugin endpoint on a WordPress site. When an authenticated site user visits the attacker's page, the browser sends the forged request with valid session cookies attached. The plugin processes the request without verifying a valid nonce, executing the state change on behalf of the victim. See the Patchstack CSRF Vulnerability Report for advisory details.
Detection Methods for CVE-2024-43338
Indicators of Compromise
- Unexpected modifications to poll, survey, or plugin configuration data with no corresponding admin activity in audit logs.
- Requests to Crowdsignal Dashboard plugin endpoints containing Referer headers pointing to external, unrelated domains.
- POST requests to plugin handlers lacking a valid _wpnonce parameter or with anomalous session context.
Detection Strategies
- Enable and review WordPress admin action logs to correlate plugin changes with legitimate authenticated sessions.
- Deploy a Web Application Firewall (WAF) rule to flag cross-origin POST requests targeting polldaddy plugin routes.
- Monitor server access logs for plugin endpoints receiving traffic from users whose Referer header does not match the WordPress admin origin.
Monitoring Recommendations
- Track plugin version inventory across all managed WordPress installations to identify hosts still running polldaddy <= 3.1.3.
- Alert on administrator or editor accounts making plugin state changes outside expected working hours or from unusual browser sessions.
- Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention.
How to Mitigate CVE-2024-43338
Immediate Actions Required
- Update the Crowdsignal Dashboard – Polls, Surveys & more plugin to a version newer than 3.1.3 as soon as a fixed release is available from the vendor.
- If no fixed version is currently available, disable and remove the plugin from affected WordPress sites.
- Instruct administrators and editors to log out of WordPress before browsing untrusted sites and to use separate browser profiles for administrative sessions.
Patch Information
Refer to the Patchstack advisory for CVE-2024-43338 for the latest guidance on fixed versions and mitigation. Apply vendor updates through the WordPress plugin dashboard or by replacing plugin files with the latest release from the vendor.
Workarounds
- Deploy a WAF rule to block cross-origin POST requests to plugin endpoints where the Referer header does not match the site's own admin origin.
- Restrict access to /wp-admin/ by IP allowlist so that authenticated plugin actions cannot be triggered from arbitrary user browsers.
- Enforce short session lifetimes and require re-authentication for privileged actions to reduce the window in which CSRF can succeed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
