CVE-2024-49290: Boxystudio Cooked Pro CSRF Vulnerability

CVE-2024-49290 Overview

CVE-2024-49290 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Cooked Pro WordPress plugin developed by Gora Tech LLC (Boxystudio). The flaw exists in all versions prior to 1.8.0 and is categorized under [CWE-352]. An attacker can craft a malicious web page that triggers privileged actions in the plugin when an authenticated WordPress user visits it. Successful exploitation requires user interaction but no prior authentication on the attacker side. The issue impacts the confidentiality, integrity, and availability of affected WordPress sites running the vulnerable plugin.

Critical Impact
Attackers can coerce authenticated administrators into executing unintended state-changing actions on the WordPress site, leading to full compromise of plugin-managed data and site configuration.

Affected Products

Gora Tech LLC (Boxystudio) Cooked Pro WordPress plugin
All versions prior to 1.8.0
WordPress sites using Cooked Pro for recipe management

Discovery Timeline

2024-10-20 - CVE-2024-49290 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-49290

Vulnerability Analysis

The Cooked Pro plugin fails to properly validate the origin of state-changing HTTP requests. Endpoints handling sensitive operations do not enforce anti-CSRF tokens or nonce verification through WordPress's wp_verify_nonce() mechanism. An attacker who lures an authenticated user, typically an administrator, to a controlled page can submit forged requests that execute privileged plugin actions in the user's session context. Because the request originates from the victim's authenticated browser, the WordPress site processes it as legitimate. The vulnerability is network-accessible, requires low attack complexity, and depends on user interaction such as clicking a crafted link or loading a malicious page.

Root Cause

The root cause is missing or improperly implemented CSRF protection [CWE-352]. The plugin's request handlers do not verify a unique per-session token before processing changes, allowing cross-origin requests to be honored when accompanied by valid session cookies.

Attack Vector

The attack vector is network-based and exploits the trust the WordPress application places in the victim's browser cookies. The attacker hosts a page containing an auto-submitting form or image tag targeting a vulnerable Cooked Pro endpoint. When an authenticated administrator visits the page, the browser automatically attaches the WordPress session cookie. The vulnerable endpoint processes the action without verifying request origin. Refer to the PatchStack CSRF Vulnerability Report for additional technical context.

No verified public exploit code is available for this CVE. The vulnerability mechanism is described in prose based on the CWE-352 pattern and vendor advisory.

Detection Methods for CVE-2024-49290

Indicators of Compromise

Unexpected modifications to recipe content, plugin settings, or user accounts managed by Cooked Pro
HTTP POST or GET requests to plugin endpoints with Referer headers pointing to untrusted third-party domains
Administrator session activity originating from unusual IP addresses or user agents shortly after visiting external sites
Web server access logs showing state-changing requests without corresponding administrator navigation patterns

Detection Strategies

Inspect WordPress audit logs for plugin configuration changes that do not match administrator activity timelines
Correlate Referer headers in web server logs against expected wp-admin referrers for Cooked Pro endpoints
Deploy a web application firewall rule to flag requests to Cooked Pro endpoints missing valid WordPress nonce parameters

Monitoring Recommendations

Enable WordPress activity logging plugins to capture all administrator-level changes with timestamps and source IPs
Forward web server and WordPress logs to a centralized SIEM for correlation across sessions and origins
Alert on outbound browser activity from administrator workstations to newly registered or low-reputation domains

How to Mitigate CVE-2024-49290

Immediate Actions Required

Update Cooked Pro to version 1.8.0 or later on every WordPress site running the plugin
Audit administrator accounts and recent plugin configuration changes for signs of unauthorized actions
Force a password reset and session invalidation for all WordPress administrator accounts
Restrict wp-admin access by source IP where operationally feasible

Patch Information

Gora Tech LLC has released Cooked Pro version 1.8.0 which addresses the missing CSRF token validation. Administrators should upgrade through the WordPress plugin manager or by downloading the patched release from the vendor. Refer to the PatchStack advisory for the official remediation guidance.

Workarounds

Disable the Cooked Pro plugin until the upgrade to 1.8.0 can be applied
Instruct administrators to log out of WordPress before browsing untrusted sites
Deploy a SameSite=Strict cookie policy on the WordPress session cookie via a security plugin or reverse proxy
Implement a web application firewall rule blocking cross-origin POST requests to Cooked Pro endpoints

bash

# Example WAF rule (ModSecurity) to block cross-origin POSTs to Cooked Pro endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1004929,msg:'Cross-origin POST to Cooked Pro blocked'"
  SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain"
    SecRule ARGS:action "@beginsWith cooked_" \
      "chain"
      SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" \
        "t:lowercase"