CVE-2024-50534 Overview
CVE-2024-50534 is a Cross-Site Request Forgery (CSRF) vulnerability in the techdabang World Prayer Time WordPress plugin. The flaw affects all plugin versions up to and including 2.0. Successful exploitation can lead to Stored Cross-Site Scripting (XSS) on the affected WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. According to the Patchstack Vulnerability Report, the issue requires user interaction such as an authenticated administrator visiting an attacker-controlled page.
Critical Impact
An attacker can trick an authenticated WordPress administrator into submitting a forged request that injects persistent malicious JavaScript into plugin-controlled output, enabling stored XSS against any visitor.
Affected Products
- techdabang World Prayer Time WordPress plugin (world-prayer-time)
- All versions from n/a through 2.0
- WordPress sites running the vulnerable plugin
Discovery Timeline
- 2024-11-19 - CVE-2024-50534 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-50534
Vulnerability Analysis
The World Prayer Time plugin exposes state-changing functionality without verifying CSRF tokens. An attacker can craft a malicious HTML page that issues a forged request to a vulnerable plugin endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the request with the administrator's session cookies. The plugin processes the request as legitimate and stores attacker-supplied input. Because the stored input is later rendered without proper output encoding, the payload executes as JavaScript in the browser of any user who views the affected page.
The chained outcome combines two weaknesses: missing CSRF protection on a settings or content endpoint, and insufficient sanitization of user-controlled input rendered back to the page.
Root Cause
The root cause is the absence of WordPress nonce validation (wp_verify_nonce or check_admin_referer) on plugin request handlers, combined with missing input sanitization and output escaping. The plugin trusts incoming POST or GET data from authenticated sessions without verifying request origin.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that auto-submits a request to the vulnerable plugin endpoint. A logged-in administrator who visits the page unknowingly triggers the request. The injected script then runs in the context of the WordPress site whenever the affected output is rendered.
No verified proof-of-concept code has been published. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-50534
Indicators of Compromise
- Unexpected <script> tags, event handlers, or obfuscated JavaScript stored in plugin settings or rendered pages.
- WordPress access logs showing POST requests to world-prayer-time plugin endpoints originating from external Referer headers.
- New or modified plugin options containing HTML or JavaScript payloads where plain text is expected.
Detection Strategies
- Audit the WordPress database (wp_options and plugin tables) for entries associated with world-prayer-time containing script tags or HTML entities.
- Inspect rendered pages on the front end for unexpected inline scripts or remote script includes.
- Review web server logs for administrator-session requests to plugin handlers lacking a nonce parameter or with cross-origin Referer values.
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin setting changes with user, timestamp, and source IP.
- Deploy a web application firewall (WAF) rule that inspects POST bodies destined for plugin endpoints and blocks payloads containing script tags.
- Alert on outbound browser connections from administrator workstations to unfamiliar domains shortly after WordPress admin activity.
How to Mitigate CVE-2024-50534
Immediate Actions Required
- Deactivate and remove the World Prayer Time plugin until a patched version is confirmed available.
- Audit all plugin-controlled content and settings for injected scripts and remove malicious payloads.
- Force a password reset for WordPress administrator accounts and invalidate active sessions.
- Restrict WordPress administrative access to known IP addresses where feasible.
Patch Information
At the time of publication, no fixed version has been identified in the available advisory. The Patchstack Vulnerability Report indicates the issue affects versions up to and including 2.0. Monitor the plugin's WordPress.org page and the vendor advisory for an updated release and apply it as soon as it is published.
Workarounds
- Uninstall the plugin if it is not business-critical.
- Require administrators to log out of WordPress before browsing untrusted sites and use a dedicated browser profile for admin tasks.
- Deploy a WAF policy that enforces same-origin Referer checks on plugin POST endpoints and strips HTML from inputs.
- Apply Content Security Policy (CSP) headers to limit inline script execution on the WordPress front end.
# Disable the vulnerable plugin via WP-CLI until a patched version is available
wp plugin deactivate world-prayer-time
wp plugin delete world-prayer-time
# Optional: add a restrictive CSP via .htaccess to limit XSS impact
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
