CVE-2024-49627: WordPress Image SEO CSRF Vulnerability

CVE-2024-49627 Overview

CVE-2024-49627 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Noor Alam WordPress Image SEO plugin. The flaw exists in all versions up to and including 1.1.4. An attacker can trick an authenticated administrator into submitting forged requests that perform privileged actions on the WordPress site. The vulnerability is tracked under CWE-352 and is documented in the Patchstack Vulnerability Report.

Critical Impact

Successful exploitation lets an unauthenticated attacker abuse an authenticated administrator's session to modify plugin state, with potential downstream impact to site confidentiality, integrity, and availability.

Affected Products

• Noor Alam WordPress Image SEO plugin versions up to and including 1.1.4
• WordPress sites running the wp-image-seo plugin from noorsplugin
• All WordPress installations where the vulnerable plugin is active and accessible to administrators

Discovery Timeline

• 2024-10-20 - CVE-2024-49627 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-49627

Vulnerability Analysis

The WordPress Image SEO plugin fails to validate the origin and intent of state-changing requests. Plugin endpoints handling administrative actions do not verify a WordPress nonce or equivalent anti-CSRF token. An attacker hosting a malicious page can craft an HTML form or JavaScript payload that submits a forged request to the target WordPress site. If a logged-in administrator visits the attacker-controlled page, the browser sends the request with valid session cookies, and the plugin executes the action.

The attack requires user interaction, which aligns with classic CSRF exploitation patterns. Because WordPress administrators hold broad privileges, the impact extends to plugin configuration changes that can be leveraged for further compromise. Patchstack classifies the flaw within CWE-352: Cross-Site Request Forgery.

Root Cause

The root cause is missing CSRF protection on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives that bind sensitive actions to a per-session token. The vulnerable handlers in WordPress Image SEO 1.1.4 and earlier do not call these verification functions before processing form submissions or AJAX requests, leaving session-authenticated state changes exposed to forgery.

Attack Vector

Exploitation is network-based and requires no privileges on the target. The attacker delivers a crafted link or embeds a forged request on a webpage. When an authenticated administrator visits the page, the browser automatically attaches WordPress authentication cookies, and the malicious request executes with administrator privileges. The vulnerability does not require credentials or prior access to the target instance.

No public proof-of-concept exploit is currently listed, and the EPSS probability is 0.272%.

Detection Methods for CVE-2024-49627

Indicators of Compromise

• Unexpected modifications to WordPress Image SEO plugin configuration or stored options
• HTTP POST or GET requests to plugin endpoints with Referer headers pointing to external, untrusted domains
• Administrator account activity originating from sessions that did not load the corresponding plugin admin page
• Web server access logs showing plugin actions triggered without prior navigation to the plugin settings UI

Detection Strategies

• Monitor WordPress wp-admin and admin-ajax.php traffic for requests to wp-image-seo handlers that lack a valid nonce parameter
• Compare Referer and Origin headers against the site's own domain for any state-changing plugin request
• Audit the WordPress options table and plugin-specific settings for unauthorized changes correlated with administrator browsing activity

Monitoring Recommendations

• Enable WordPress audit logging to capture plugin settings changes and the source IP and user agent of each action
• Alert on outbound HTTP requests from administrator browsers to known malicious or newly registered domains preceding plugin configuration changes
• Forward web server and WordPress application logs to a centralized analytics platform to correlate forged-request patterns across sessions

How to Mitigate CVE-2024-49627

Immediate Actions Required

• Update the WordPress Image SEO plugin to a version newer than 1.1.4 once a fixed release is published by the vendor
• Deactivate and remove the plugin if no patched version is available and the functionality is not essential
• Require administrators to log out of WordPress sessions before browsing untrusted sites and to use dedicated browser profiles for administrative work

Patch Information

Refer to the Patchstack advisory for the current patch status. The advisory lists affected versions through 1.1.4. Confirm the installed plugin version under WordPress Plugins > Installed Plugins and apply the vendor update as soon as it becomes available.

Workarounds

• Restrict access to wp-admin by IP allowlist at the web server or WAF layer to reduce exposure of authenticated sessions
• Deploy a WordPress security plugin or WAF rule that enforces Referer and Origin validation on plugin admin requests
• Reduce the number of accounts with administrator privileges and enforce short session lifetimes for those accounts

# Example: deactivate the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate wp-image-seo
wp plugin status wp-image-seo