CVE-2024-51634 Overview
CVE-2024-51634 is a Cross-Site Request Forgery (CSRF) vulnerability in the Webriti Custom Login WordPress plugin (webriti-custom-login-page) developed by a.ankit. The flaw chains CSRF with Reflected Cross-Site Scripting (XSS), allowing attackers to execute malicious scripts in a victim's browser session. The vulnerability affects all plugin versions up to and including 0.3. Exploitation requires user interaction, typically by tricking an authenticated administrator into clicking a crafted link. The issue is tracked under CWE-352: Cross-Site Request Forgery and was published to the National Vulnerability Database on November 19, 2024.
Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in an administrator's browser, potentially leading to session theft, account takeover, or unauthorized configuration changes on the WordPress site.
Affected Products
- Webriti Custom Login plugin (webriti-custom-login-page) versions through 0.3
- WordPress installations with the vulnerable plugin enabled
- Sites where administrators can be social-engineered into clicking attacker-crafted links
Discovery Timeline
- 2024-11-19 - CVE-2024-51634 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51634
Vulnerability Analysis
The vulnerability combines two weaknesses into a single attack chain. First, the plugin lacks CSRF protections such as nonce validation on sensitive request handlers. Second, user-supplied input is reflected back into HTTP responses without proper output encoding or sanitization. An attacker hosts a malicious page or sends a crafted link that, when visited by an authenticated WordPress user, issues a forged request to the vulnerable endpoint. The server then reflects attacker-controlled payload data into the response, where it executes as JavaScript in the victim's browser context.
The attack scope extends beyond the vulnerable component because the executing script runs with the privileges of the targeted user. When that user is a WordPress administrator, the impact can include session cookie exfiltration, plugin configuration tampering, and persistence through additional administrative actions.
Root Cause
The root cause is twofold: missing anti-CSRF tokens on plugin request handlers and insufficient input validation or output encoding on reflected parameters. WordPress provides wp_nonce_field() and check_admin_referer() helpers to mitigate CSRF, and esc_html() or esc_attr() for output escaping. The vulnerable plugin code paths do not consistently apply these controls.
Attack Vector
Exploitation requires no authentication on the attacker side but does require user interaction. An attacker crafts a malicious URL or HTML form targeting the plugin endpoint, embedding a JavaScript payload in a parameter that the server reflects unescaped. The attacker then delivers this link through phishing email, a comment on another site, or a malicious advertisement. When an authenticated WordPress user opens the link, the browser sends the forged request along with the user's session cookies, and the reflected script executes in the WordPress origin. Refer to the Patchstack Vulnerability Report for further technical context.
Detection Methods for CVE-2024-51634
Indicators of Compromise
- HTTP requests to webriti-custom-login-page plugin endpoints containing URL-encoded <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload=
- Referer headers pointing to external domains preceding requests to plugin administrative endpoints
- Unexpected modifications to WordPress administrator accounts or plugin configuration shortly after a user clicks an external link
Detection Strategies
- Inspect web server access logs for plugin URLs containing reflected parameters with HTML or JavaScript metacharacters
- Deploy Web Application Firewall (WAF) rules that match common XSS payload patterns against requests to /wp-content/plugins/webriti-custom-login-page/
- Monitor for missing or invalid _wpnonce parameters on POST requests to plugin handlers
Monitoring Recommendations
- Enable WordPress audit logging to capture administrator session activity, plugin setting changes, and user role modifications
- Alert on outbound connections from administrator workstations to newly registered or low-reputation domains immediately after WordPress admin activity
- Track failed and successful login events on administrative accounts for anomalies that may indicate hijacked sessions
How to Mitigate CVE-2024-51634
Immediate Actions Required
- Deactivate and remove the Webriti Custom Login plugin if a patched version is not available for your environment
- Restrict WordPress administrator access to dedicated browsers or sessions not used for general browsing or email
- Apply WAF rules to block reflected XSS patterns targeting the plugin path until the plugin is removed or patched
Patch Information
At the time of publication, no fixed version is listed for the Webriti Custom Login plugin beyond version 0.3. Site owners should consult the Patchstack advisory and the WordPress plugin repository for updated release information before re-enabling the plugin.
Workarounds
- Replace the plugin with an actively maintained alternative that implements CSRF nonces and output escaping
- Enforce a strict Content Security Policy (CSP) on the WordPress site to limit inline script execution
- Require administrators to use multi-factor authentication so that stolen session cookies alone do not grant persistent access
# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate webriti-custom-login-page
wp plugin delete webriti-custom-login-page
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
