CVE-2024-50466: Darkmysite WordPress CSRF Vulnerability

CVE-2024-50466 Overview

CVE-2024-50466 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the DarkMySite – Advanced Dark Mode Plugin for WordPress. The flaw exists in all versions up to and including 1.2.8. Attackers can craft malicious web pages that trigger unauthorized state-changing actions on the WordPress site when an authenticated administrator visits them. The vulnerability is classified under CWE-352 and stems from missing or improper CSRF token validation in plugin request handlers. Successful exploitation requires user interaction, but the attack can be launched remotely over the network without prior authentication on the target site.

Critical Impact
Attackers can forge requests that modify plugin settings or perform privileged actions on behalf of an authenticated WordPress administrator, leading to high impact across confidentiality, integrity, and availability.

Affected Products

DarkMySite – Advanced Dark Mode Plugin for WordPress
Versions from n/a through 1.2.8
WordPress sites running the vulnerable plugin

Discovery Timeline

2024-10-29 - CVE-2024-50466 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50466

Vulnerability Analysis

The DarkMySite plugin exposes administrative endpoints that change plugin state without validating an anti-CSRF token. WordPress provides nonce primitives such as wp_create_nonce() and check_admin_referer() for this purpose, but the affected handlers do not enforce them consistently. An attacker hosts a malicious page containing a forged form or JavaScript request targeting the plugin endpoint. When a logged-in administrator visits the page, the browser automatically attaches the WordPress session cookie. The plugin then processes the request as if it were a legitimate administrative action.

Root Cause

The root cause is missing CSRF protection [CWE-352] on plugin action handlers up to version 1.2.8. Server-side code accepts authenticated requests based solely on session cookies, without validating a nonce tied to the user session and action context.

Attack Vector

Exploitation occurs over the network and requires the victim administrator to interact with attacker-controlled content. The attacker delivers a link or embedded resource through phishing, a compromised site, or a malicious advertisement. No prior authentication on the target site is required by the attacker. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-50466

Indicators of Compromise

Unexpected changes to DarkMySite plugin configuration or appearance settings in wp-admin.
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external domains.
Administrator session activity originating from unusual user-agent strings or geolocations immediately following link clicks.

Detection Strategies

Review WordPress audit logs for plugin setting modifications correlated with administrator browsing activity.
Inspect web server logs for cross-origin POST requests to /wp-admin/admin-ajax.php or plugin-specific routes lacking valid nonce parameters.
Deploy a Web Application Firewall (WAF) rule that flags requests to DarkMySite endpoints with mismatched or missing Referer and Origin headers.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record administrator-initiated configuration changes with timestamps and source IP.
Alert on first-seen external referrers preceding administrative state changes.
Monitor for plugin file modifications outside of scheduled update windows.

How to Mitigate CVE-2024-50466

Immediate Actions Required

Update the DarkMySite plugin to a version newer than 1.2.8 once a patched release is available from the vendor.
If no patched version exists, deactivate and remove the plugin until a fix is published.
Audit administrator accounts and recent plugin configuration changes for unauthorized modifications.

Patch Information

The vulnerability affects DarkMySite versions up to and including 1.2.8. Consult the Patchstack Vulnerability Report for current patch availability and the vendor's WordPress.org plugin page for the latest release.

Workarounds

Deploy a WAF or virtual patching solution that enforces same-origin checks on WordPress administrative endpoints.
Require administrators to use a dedicated browser profile for wp-admin activity to reduce cross-site request exposure.
Restrict access to /wp-admin/ by IP allowlist where operationally feasible.
Train administrators to avoid clicking untrusted links while authenticated to WordPress.

bash

# Example nginx rule to restrict wp-admin access by IP allowlist
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}