CVE-2024-49628: Most And Least Read Posts Widget CSRF Flaw

CVE-2024-49628 Overview

CVE-2024-49628 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Most And Least Read Posts Widget WordPress plugin developed by whiletrue. The flaw impacts all versions up to and including 2.5.18. Attackers can trick authenticated WordPress users into submitting forged requests that perform unauthorized state-changing actions on the affected site. The vulnerability carries a CVSS 3.1 score of 8.8 and requires user interaction to succeed.

Critical Impact
Successful exploitation allows attackers to alter plugin settings or trigger privileged actions on behalf of an authenticated administrator, resulting in high impact to confidentiality, integrity, and availability of the WordPress site.

Affected Products

whiletrue Most And Least Read Posts Widget WordPress plugin
All versions from n/a through <= 2.5.18
WordPress sites with the most-and-least-read-posts-widget plugin installed and active

Discovery Timeline

2024-10-20 - CVE-2024-49628 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49628

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens in privileged request handlers within the most-and-least-read-posts-widget plugin. WordPress plugins typically enforce CSRF protection through nonces created with wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce(). When these controls are absent or incorrectly implemented, the browser's automatic inclusion of session cookies allows a remote page to submit authenticated requests on the user's behalf.

The attack vector is network-based and requires user interaction, meaning an authenticated administrator must visit a malicious page or click a crafted link while logged into WordPress. Once triggered, the forged request executes with the victim's session privileges, enabling modification of plugin configuration or other administrative operations exposed by the vulnerable endpoints. The EPSS probability is currently low, but the impact scope on the affected plugin remains high.

Root Cause

The root cause is the absence of proper CSRF token validation on one or more request handlers within the plugin. Without nonce verification, the plugin cannot distinguish between a legitimate administrator action initiated from the WordPress admin UI and a forged request originating from an attacker-controlled origin.

Attack Vector

An attacker hosts a malicious HTML page containing an auto-submitting form or JavaScript that targets the vulnerable plugin endpoint on the victim's WordPress site. When a logged-in administrator visits this page, the browser attaches the WordPress session cookie and submits the request. The plugin processes it as legitimate because no anti-CSRF token is validated. No proof-of-concept has been published, and this vulnerability is not listed in CISA KEV.

Refer to the Patchstack advisory for CVE-2024-49628 for additional technical details.

Detection Methods for CVE-2024-49628

Indicators of Compromise

Unexpected changes to Most And Least Read Posts Widget plugin settings within wp-admin without corresponding administrator activity records.
HTTP POST requests to plugin endpoints containing a Referer header that points to an external, untrusted origin.
Administrator sessions generating plugin configuration requests immediately after visiting third-party links or email attachments.

Detection Strategies

Inspect web server access logs for POST requests to wp-admin/admin.php or plugin-specific endpoints where the Referer header is missing or points outside the site's own domain.
Correlate WordPress audit log entries for plugin setting changes with authenticated user browsing history to identify anomalous activity patterns.
Deploy a Web Application Firewall (WAF) rule to flag state-changing requests to the plugin without a valid nonce parameter.

Monitoring Recommendations

Enable WordPress audit logging plugins to track configuration changes and administrator actions in real time.
Monitor for anomalous browser navigation from administrator accounts to unfamiliar domains, followed by admin actions on the WordPress site.
Set alerts on modification timestamps for plugin option rows in the wp_options database table.

How to Mitigate CVE-2024-49628

Immediate Actions Required

Update the most-and-least-read-posts-widget plugin to a version above 2.5.18 once a fixed release is available from the vendor.
Restrict administrator access to trusted networks and require re-authentication for privileged actions.
Instruct administrators to log out of WordPress before browsing untrusted sites or opening unsolicited links.

Patch Information

At the time of publication, the advisory identifies all versions through 2.5.18 as affected. Consult the Patchstack advisory and the WordPress plugin repository for the latest fixed version and apply it across all impacted sites.

Workarounds

Deactivate and remove the most-and-least-read-posts-widget plugin until a patched version is confirmed available.
Deploy a WAF rule that blocks cross-origin POST requests to WordPress admin endpoints when the Referer header does not match the site's own domain.
Enforce SameSite cookie attributes on WordPress authentication cookies to reduce cross-site request delivery.
Require administrators to use dedicated browser profiles or sessions isolated from general web browsing.

bash

# Example Apache mod_security rule to block cross-origin POSTs to wp-admin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1004962,phase:1,deny,status:403,\
   msg:'Blocked cross-origin POST to wp-admin'"
SecRule REQUEST_URI "@beginsWith /wp-admin/" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com/"