CVE-2024-49335 Overview
CVE-2024-49335 is a Cross-Site Request Forgery (CSRF) vulnerability in the googledrive-folder-list WordPress plugin by sh4d0w28 (edush_maxim). The flaw affects all plugin versions up to and including 2.2.2. An attacker can chain the CSRF issue with a Stored Cross-Site Scripting (XSS) payload to inject persistent JavaScript into pages served by the plugin. Exploitation requires an authenticated administrator to interact with an attacker-controlled request, such as visiting a crafted page. Successful exploitation results in script execution in the context of site visitors and administrators.
Critical Impact
A remote, unauthenticated attacker can persist arbitrary JavaScript in WordPress sites running the GoogleDrive folder list plugin by tricking an authenticated administrator into submitting a forged request.
Affected Products
- WordPress plugin: GoogleDrive folder list (googledrive-folder-list)
- Vendor: sh4d0w28 / edush_maxim
- All versions through 2.2.2
Discovery Timeline
- 2024-10-20 - CVE-2024-49335 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49335
Vulnerability Analysis
The vulnerability is classified under CWE-352: Cross-Site Request Forgery. The plugin exposes state-changing administrative actions without validating a CSRF nonce or origin. An attacker hosts a crafted HTML page that issues a forged POST or GET request to a vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser submits the request with valid session cookies. The plugin processes the request and stores attacker-supplied input without sanitization or output encoding, resulting in Stored XSS. Because the payload persists in plugin data, it executes each time an affected page renders.
Root Cause
The root cause is the absence of anti-CSRF token verification on privileged plugin actions combined with insufficient input sanitization. The plugin does not call WordPress helpers such as check_admin_referer() or wp_verify_nonce() before writing user-controlled data to persistent storage. Data returned to the browser is not escaped with functions like esc_html() or esc_attr(), allowing HTML and JavaScript to render.
Attack Vector
Exploitation is network-based and requires user interaction from a privileged WordPress user. The attacker delivers a link or embeds a hidden form on a page under their control. When the administrator loads the page while authenticated to WordPress, the browser transmits the forged request. The stored payload then executes for anyone rendering the affected view, enabling session theft, administrative account takeover, or plugin-based pivoting. No verified proof-of-concept code is publicly available. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-49335
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes stored in plugin configuration rows within the wp_options or plugin-specific tables.
- Outbound requests from visitor browsers to unknown domains when loading pages that embed the GoogleDrive folder list widget.
- New or modified administrator accounts created after an admin visited an external link.
Detection Strategies
- Review web server access logs for POST requests to plugin admin endpoints lacking a valid Referer header matching the site origin.
- Inspect the plugin's stored settings for HTML entities, script tags, or JavaScript event handlers.
- Deploy a Web Application Firewall (WAF) rule that flags requests to wp-admin plugin endpoints with cross-origin Referer values.
Monitoring Recommendations
- Monitor WordPress database changes to plugin option rows and alert on writes containing HTML tags or javascript: URIs.
- Track administrator session activity and browser Content Security Policy (CSP) violation reports.
- Alert on newly registered outbound domains referenced from rendered plugin pages.
How to Mitigate CVE-2024-49335
Immediate Actions Required
- Deactivate the GoogleDrive folder list plugin until a patched version is confirmed installed.
- Audit plugin settings and stored folder-list data for injected scripts and remove any malicious content.
- Force password resets for all WordPress administrator accounts and invalidate active sessions.
Patch Information
No fixed version is listed in the NVD entry at time of publication. The advisory covers all releases through 2.2.2. Consult the Patchstack advisory for the current fix status and vendor communication.
Workarounds
- Remove the plugin from production sites where a patched version is unavailable.
- Restrict access to /wp-admin/ by IP allowlist to reduce exposure to CSRF delivery.
- Deploy a Content Security Policy that blocks inline scripts and untrusted script sources on rendered plugin pages.
- Require administrators to use isolated browser profiles when managing WordPress to limit cross-site cookie exposure.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate googledrive-folder-list
wp plugin delete googledrive-folder-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
