CVE-2024-49274: Infomaniak VOD Infomaniak CSRF Vulnerability

CVE-2024-49274 Overview

CVE-2024-49274 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Infomaniak vod-infomaniak WordPress plugin. The flaw impacts all versions from n/a through 1.5.7. An attacker can craft a malicious request that, when triggered by an authenticated user visiting an attacker-controlled page, executes privileged actions in the WordPress site without consent. The weakness is categorized under CWE-352. Successful exploitation can lead to high impact on confidentiality, integrity, and availability of the affected WordPress instance.

Critical Impact
Attackers can coerce authenticated WordPress users into executing unauthorized state-changing actions in the vod-infomaniak plugin, resulting in compromise of site configuration and data.

Affected Products

Infomaniak VOD Infomaniak (vod-infomaniak) WordPress plugin versions up to and including 1.5.7
WordPress sites with the vod-infomaniak plugin installed and active
Any administrator or privileged user session interacting with a vulnerable plugin endpoint

Discovery Timeline

2024-10-20 - CVE-2024-49274 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-49274

Vulnerability Analysis

The vulnerability resides in the Infomaniak vod-infomaniak WordPress plugin, which fails to validate the origin or authenticity of state-changing HTTP requests. The plugin does not enforce WordPress nonces or equivalent anti-CSRF tokens on sensitive actions. An attacker exploits this by hosting a malicious page or link that issues a forged request to the vulnerable endpoint. When an authenticated WordPress user, typically an administrator, visits the attacker-controlled resource, the browser automatically attaches valid session cookies. The request executes with the victim's privileges, enabling unauthorized modifications.

The attack requires user interaction but no prior authentication of the attacker, and can be delivered over the network. Exploitation yields high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is missing or insufficient CSRF protection in the plugin's request handlers. WordPress provides built-in nonce mechanisms via wp_create_nonce() and check_admin_referer(), but the affected versions of vod-infomaniak omit these checks on sensitive operations. This allows any cross-origin request bearing the victim's session cookie to be processed as legitimate.

Attack Vector

Exploitation occurs over the network and requires user interaction. The attacker prepares a webpage, email, or link containing a forged HTTP request targeting the vulnerable plugin endpoint. The victim, while authenticated to the WordPress site, visits the resource. The browser submits the forged request automatically, and the plugin executes the action without verifying the request origin. The full technical writeup is available in the Patchstack CSRF Vulnerability Analysis.

Detection Methods for CVE-2024-49274

Indicators of Compromise

Unexpected configuration changes within the vod-infomaniak plugin settings in the WordPress admin panel
HTTP POST or GET requests to plugin endpoints with Referer headers pointing to external, untrusted domains
Administrator account activity originating from unusual times or IP addresses correlated with plugin actions

Detection Strategies

Inspect web server access logs for requests to vod-infomaniak plugin URLs lacking valid WordPress nonce parameters such as _wpnonce
Compare cross-origin Referer and Origin headers against the WordPress site's domain for plugin admin actions
Enable WordPress audit logging to track plugin setting changes and correlate with user sessions

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM or data lake for behavioral analytics on admin actions
Alert on plugin configuration changes performed outside of authenticated admin browser sessions
Monitor outbound user browsing activity from administrator workstations for visits to suspicious domains preceding plugin changes

How to Mitigate CVE-2024-49274

Immediate Actions Required

Update the vod-infomaniak plugin to a version newer than 1.5.7 once the vendor publishes a fix
Deactivate and remove the plugin if a patched version is not yet available and the functionality is non-essential
Require administrators to log out of WordPress when not actively performing administrative tasks to limit CSRF exposure

Patch Information

At the time of publication, the vulnerability affects vod-infomaniak up to and including version 1.5.7. Refer to the Patchstack advisory for the latest patch status and upgrade guidance.

Workarounds

Deploy a web application firewall (WAF) rule that blocks requests to vod-infomaniak plugin endpoints lacking a valid _wpnonce parameter or matching same-origin Referer
Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress session cookies to reduce cross-site request risk
Restrict WordPress administrative access to a dedicated browser profile or network segment to limit exposure to attacker-controlled web content

bash

# Example WAF rule concept: drop POST requests to the plugin without a same-origin Referer
# Pseudocode for an Nginx/ModSecurity-style rule
if ($http_referer !~* "^https?://your-wordpress-domain\.tld") {
    return 403;
}