CVE-2024-50533: Domain Sharding CSRF Vulnerability

CVE-2024-50533 Overview

CVE-2024-50533 is a Cross-Site Request Forgery (CSRF) vulnerability in the David Garcia Domain Sharding WordPress plugin. The flaw affects all versions of domain-sharding up to and including 1.2.1. An attacker can chain the CSRF weakness with Stored Cross-Site Scripting (XSS), enabling persistent script injection into the WordPress site.

Exploitation requires an authenticated administrator to visit an attacker-controlled page. Once triggered, the forged request writes malicious JavaScript into plugin configuration, which executes for every subsequent visitor. The vulnerability maps to [CWE-352: Cross-Site Request Forgery].

Critical Impact

Successful exploitation stores attacker-controlled JavaScript in the WordPress site, enabling session theft, administrative account takeover, and drive-by malware delivery to site visitors.

Affected Products

• David Garcia Domain Sharding WordPress plugin (domain-sharding)
• All versions from n/a through 1.2.1
• WordPress installations with the plugin active and accessible to administrators

Discovery Timeline

• 2024-11-19 - CVE-2024-50533 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50533

Vulnerability Analysis

The Domain Sharding plugin exposes administrative actions that modify persistent plugin settings without validating a request-specific anti-CSRF token. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for exactly this purpose, but the affected handler omits them.

Because the settings values are later rendered into administrative pages without sufficient output escaping, attacker-supplied JavaScript persists as Stored XSS. The payload executes in the browser context of any administrator viewing the affected page. The EPSS probability is 0.194% at percentile 9.283, indicating low observed exploitation activity at the time of publication.

Root Cause

The root cause is missing CSRF protection [CWE-352] on state-changing plugin endpoints. The handler accepts POST parameters and writes them to the WordPress options table without verifying request origin. A secondary defect - insufficient sanitization of stored values - transforms the CSRF into Stored XSS.

Attack Vector

An attacker crafts a malicious HTML page containing an auto-submitting form targeting the vulnerable plugin endpoint. The attacker then lures a logged-in WordPress administrator to the page through phishing or a watering-hole. The browser attaches the administrator's session cookies to the forged request, and the plugin persists the attacker's XSS payload. Every subsequent administrator visit to the affected page triggers execution of the injected script.

Refer to the Patchstack advisory for the Domain Sharding CSRF-to-Stored-XSS issue for full technical detail.

Detection Methods for CVE-2024-50533

Indicators of Compromise

• Unexpected <script> tags, event handlers, or encoded JavaScript stored in WordPress wp_options entries related to domain-sharding
• Administrator sessions initiating outbound requests to unknown domains after visiting plugin configuration pages
• New or modified administrator accounts created shortly after plugin settings changes
• Referer headers on plugin update requests pointing to external, attacker-controlled origins

Detection Strategies

• Inspect the WordPress database for plugin option values containing HTML or script content that should be plain configuration data
• Enable WordPress audit logging to capture options.php and plugin-specific admin-post actions along with the originating Referer
• Deploy a web application firewall rule that blocks POST requests to plugin admin endpoints when no valid WordPress nonce is present

Monitoring Recommendations

• Alert on modifications to Domain Sharding plugin settings by any administrator account
• Monitor browser telemetry from administrator endpoints for script executions loading remote JavaScript from unknown hosts
• Track authentication events for newly elevated or created administrator accounts following plugin configuration changes

How to Mitigate CVE-2024-50533

Immediate Actions Required

• Deactivate and remove the Domain Sharding plugin until an upstream fix is confirmed, since no patched version is listed for versions after 1.2.1
• Audit wp_options and plugin-managed settings for injected script content and restore clean values
• Rotate WordPress administrator credentials and invalidate active sessions if the plugin was in use

Patch Information

No vendor-supplied patched release is identified in the NVD or Patchstack advisory at the time of publication. Consult the Patchstack vulnerability entry for updates on remediation availability.

Workarounds

• Remove the domain-sharding plugin from any WordPress site running version 1.2.1 or earlier
• Restrict access to /wp-admin/ using IP allowlists or VPN-only access to reduce CSRF exposure
• Require administrators to log out of WordPress before browsing untrusted sites and enforce short session lifetimes
• Deploy a Content Security Policy that blocks inline scripts and untrusted script sources on administrative pages

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate domain-sharding
wp plugin delete domain-sharding

# Verify removal
wp plugin list | grep domain-sharding