CVE-2024-49672: Google Docs RSVP CSRF Vulnerability

CVE-2024-49672 Overview

CVE-2024-49672 is a Cross-Site Request Forgery (CSRF) vulnerability in the Google Docs RSVP WordPress plugin developed by giffordcheung. The flaw affects all versions up to and including 2.0.1 and enables Stored Cross-Site Scripting (XSS) when exploited. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A successful attack stores attacker-controlled JavaScript in the WordPress site, executing in the browser context of any visitor and enabling session theft, defacement, or administrative account takeover.

Affected Products

Google Docs RSVP (google-docs-rsvp-guestlist) WordPress plugin
All versions from n/a through 2.0.1
WordPress installations with the plugin active

Discovery Timeline

2024-10-29 - CVE-2024-49672 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49672

Vulnerability Analysis

The Google Docs RSVP plugin exposes administrative actions without adequate CSRF protection. State-changing requests handled by the plugin lack anti-CSRF nonce validation, allowing an attacker to forge requests on behalf of an authenticated user. Because the affected endpoint also fails to sanitize input before persisting it, the forged request stores attacker-supplied HTML or JavaScript in plugin data.

Stored payloads execute in the browser of any user rendering the affected content. This chain converts a client-side social engineering primitive into persistent server-side script injection, magnifying the impact beyond a typical reflected XSS.

Root Cause

The root cause is missing CSRF token validation on request handlers that write plugin configuration or guest data. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose, but the affected handlers do not enforce them. Combined with the absence of output encoding, this creates the CSRF-to-Stored-XSS chain described in the Patchstack advisory.

Attack Vector

Exploitation requires user interaction. An attacker hosts a crafted page containing an auto-submitting form or fetch request that targets the vulnerable plugin endpoint on a WordPress site. When an authenticated administrator visits the page, the browser sends the forged request with valid session cookies. The plugin processes the request and stores the injected script.

Subsequent visits to the affected page render the payload, executing arbitrary JavaScript in the visitor's browser session. Attackers can then hijack sessions, exfiltrate data, or pivot to full site compromise.

No verified proof-of-concept code has been published. For technical details, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-49672

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in plugin database tables or WordPress wp_options entries related to google-docs-rsvp-guestlist.
WordPress admin activity logs showing plugin configuration changes without a corresponding admin session in the audit trail.
Outbound requests from administrator browsers to unfamiliar domains immediately after visiting third-party sites.
New administrative users or modified user roles created shortly after XSS payload execution.

Detection Strategies

Inspect the plugin's stored guest list and configuration fields for HTML markup, JavaScript event handlers (onerror, onload), or encoded payloads (javascript:, <script>).
Review web server access logs for POST requests to plugin endpoints that lack a matching Referer header from the WordPress admin console.
Deploy a Web Application Firewall rule to alert on requests to google-docs-rsvp-guestlist endpoints that omit the WordPress _wpnonce parameter.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/plugins/google-docs-rsvp-guestlist/ directory.
Monitor administrator session activity and correlate plugin configuration writes with authenticated admin sessions.
Alert on any newly stored content containing script tags or JavaScript URI schemes within plugin-managed database rows.

How to Mitigate CVE-2024-49672

Immediate Actions Required

Deactivate and remove the Google Docs RSVP plugin until a patched version is available, as no fixed version is listed in the advisory.
Audit the plugin's stored data for injected scripts and purge any malicious entries.
Force password resets for all WordPress administrators who may have visited untrusted external sites while authenticated.
Rotate WordPress authentication secrets in wp-config.php and invalidate active sessions.

Patch Information

The Patchstack advisory identifies all versions through 2.0.1 as vulnerable and does not list a fixed release at the time of publication. Consult the Patchstack Vulnerability Report for the latest remediation status and monitor the plugin repository for updates.

Workarounds

Remove the plugin entirely and replace it with an actively maintained RSVP alternative that enforces WordPress nonce validation.
Deploy a WordPress-aware Web Application Firewall with CSRF and XSS rulesets to block forged requests to plugin endpoints.
Restrict WordPress administrator accounts to dedicated browsers or sessions that do not visit untrusted sites, reducing the CSRF attack surface.
Apply a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.

bash

# Example WordPress CLI removal of the vulnerable plugin
wp plugin deactivate google-docs-rsvp-guestlist
wp plugin delete google-docs-rsvp-guestlist

# Example CSP header to mitigate stored XSS execution
# Add to web server configuration (nginx example)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;