CVE-2024-51635: While Loading Plugin CSRF Vulnerability

CVE-2024-51635 Overview

CVE-2024-51635 is a Cross-Site Request Forgery (CSRF) vulnerability in the Garmur While Loading (while-it-is-loading) WordPress plugin. The flaw affects all plugin versions up to and including 3.0. An attacker can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) sink, allowing persistent script injection through forged administrative requests. Successful exploitation requires an authenticated user, typically an administrator, to visit an attacker-controlled page or follow a crafted link. The injected payload persists in the WordPress database and executes in the browser context of any user who loads the affected page.

Critical Impact
Attackers can persistently inject JavaScript into WordPress sites running the while-it-is-loading plugin (versions ≤ 3.0) by tricking an authenticated administrator into triggering a forged request, leading to session theft, account takeover, or further site compromise.

Affected Products

Garmur While Loading (while-it-is-loading) WordPress plugin — all versions through 3.0
WordPress sites with the plugin installed and an authenticated admin session
Web browsers loading pages that render the stored, attacker-controlled payload

Discovery Timeline

2024-11-19 - CVE-2024-51635 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51635

Vulnerability Analysis

The vulnerability combines two distinct weaknesses. First, a plugin endpoint that modifies persistent settings lacks anti-CSRF protection, classified under [CWE-352]. Second, the user-supplied input written by that endpoint is rendered without proper output encoding, producing a Stored XSS sink. An attacker hosts a malicious page containing a hidden form or fetch request targeting the plugin's settings handler. When an authenticated administrator visits the page, the browser submits the request with valid session cookies. The plugin accepts the change and stores attacker-controlled HTML or JavaScript. The payload then runs in the browser of every visitor who triggers the loading screen rendered by the plugin.

Root Cause

The root cause is the absence of a WordPress nonce check (wp_verify_nonce or check_admin_referer) on the plugin's settings update handler. The handler also fails to sanitize input with functions such as wp_kses or sanitize_text_field before persisting it, and does not escape output with esc_html or esc_attr on render.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted link or embeds an auto-submitting form on a third-party site. The targeted administrator, already authenticated to WordPress, must load that resource in the same browser. The forged request silently updates the plugin's stored configuration with the XSS payload. No credentials, no privileges, and no direct access to the target site are required from the attacker. The vulnerability is exploitable over the network and produces a scope change because the stored payload executes against subsequent visitors. Refer to the Patchstack Vulnerability Analysis for additional context.

Detection Methods for CVE-2024-51635

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or obfuscated JavaScript in the plugin's option rows within the wp_options table.
Outbound HTTP requests from visitor browsers to unfamiliar domains immediately after page load on pages where the loading screen is rendered.
New or modified administrator accounts created shortly after an admin session loaded an external link.
Modifications to while-it-is-loading plugin settings without a corresponding entry in administrative audit logs.

Detection Strategies

Inspect database options written by the plugin for HTML, JavaScript, or encoded payloads that should not appear in benign configuration values.
Monitor HTTP POST requests to the plugin's admin handlers and flag submissions whose Referer header does not match the WordPress admin origin.
Compare browser Content Security Policy (CSP) violation reports against expected script sources for the WordPress site.

Monitoring Recommendations

Enable WordPress activity logging on plugin settings changes and review entries that lack a matching administrator authentication event.
Forward web server logs to a central analytics platform and alert on cross-origin POST requests targeting /wp-admin/admin-post.php or /wp-admin/options-general.php for this plugin.
Periodically scan rendered pages for unexpected inline scripts using automated DOM inspection.

How to Mitigate CVE-2024-51635

Immediate Actions Required

Deactivate and remove the while-it-is-loading plugin if a patched version is not available for your installation.
Force a logout of all administrator sessions and require re-authentication after rotating WordPress session keys in wp-config.php.
Audit the plugin's stored options and remove any entries containing script tags, JavaScript URIs, or HTML event handlers.
Review WordPress user accounts for unauthorized administrators or modified capabilities.

Patch Information

The Patchstack advisory lists all versions through 3.0 as affected, with no fixed version published at the time of disclosure. Monitor the Patchstack Vulnerability Analysis entry and the WordPress plugin repository for a vendor release that adds nonce verification and output escaping. Apply the patched version across all environments once available.

Workarounds

Restrict access to /wp-admin/ by IP allowlist at the web server or web application firewall to limit who can trigger forged requests.
Deploy a web application firewall rule that blocks cross-origin POST submissions to WordPress admin endpoints without a valid Referer header.
Instruct administrators to use a dedicated browser profile for WordPress administration to reduce CSRF exposure from unrelated browsing.
Apply a strict Content Security Policy that disallows inline scripts on the front end, limiting the impact of stored payloads.

bash

# Example nginx rule to block cross-origin POSTs to WordPress admin endpoints
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $csrf_block "1";
    }
    if ($http_referer ~* "^https?://your-wordpress-domain\.tld") {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
}