CVE-2024-51641: Advanced PDF Generator CSRF Vulnerability

CVE-2024-51641 Overview

CVE-2024-51641 is a Cross-Site Request Forgery (CSRF) vulnerability in the Juan Camilo Advanced PDF Generator plugin for WordPress. The flaw affects all versions up to and including 0.4.0. An attacker can chain CSRF with Stored Cross-Site Scripting (XSS), enabling persistent script injection through forged administrator requests.

The vulnerability falls under [CWE-352] Cross-Site Request Forgery. Successful exploitation requires user interaction, typically tricking an authenticated administrator into visiting an attacker-controlled page. Once triggered, malicious JavaScript persists in the plugin's stored data and executes in the browsers of subsequent visitors.

Critical Impact
An attacker can persist arbitrary JavaScript in WordPress site content via a forged administrator request, leading to session theft, defacement, or downstream account takeover.

Affected Products

Juan Camilo Advanced PDF Generator plugin for WordPress
All versions from initial release through 0.4.0
WordPress sites with the advanced-pdf-generator plugin enabled

Discovery Timeline

2024-11-19 - CVE-2024-51641 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51641

Vulnerability Analysis

The Advanced PDF Generator plugin exposes state-changing endpoints that lack proper CSRF protection. The plugin does not validate WordPress nonces on requests that modify stored configuration or content. This omission allows an attacker to craft an HTML form or JavaScript request that, when loaded by an authenticated administrator, performs privileged actions on the victim's behalf.

The forged request writes attacker-controlled input into plugin storage without adequate sanitization or output encoding. The stored payload is later rendered in the WordPress admin or front-end context, resulting in Stored XSS. The combined CSRF-to-Stored-XSS chain converts a one-time social engineering interaction into persistent code execution in the browser of any user viewing the affected page.

The attack proceeds over the network and requires user interaction, but does not require attacker authentication. The scope change reflects that injected scripts can act beyond the vulnerable component's security boundary, affecting other site users and sessions.

Root Cause

The root cause is the absence of anti-CSRF tokens (WordPress nonces validated via check_admin_referer() or wp_verify_nonce()) on plugin endpoints that accept administrator input. A secondary defect is missing input sanitization and output escaping on the same code path, allowing raw HTML and JavaScript to be stored and rendered.

Attack Vector

The attacker hosts a malicious page containing a hidden form or fetch request targeting a vulnerable plugin endpoint. The attacker lures an authenticated WordPress administrator to that page through phishing or a malicious link. The browser submits the request with the administrator's session cookies, and the plugin processes it as legitimate. The injected payload is stored and executed whenever a user renders the affected content.

No verified public exploit code is available for this CVE. See the Patchstack Vulnerability Report for vendor-supplied technical details.

Detection Methods for CVE-2024-51641

Indicators of Compromise

Unexpected <script> tags or event handlers (onerror, onload) embedded in plugin-managed content or settings
Outbound requests from administrator browsers to unknown domains shortly after visiting third-party sites
New or modified WordPress administrator accounts created without authorized change records
POST requests to advanced-pdf-generator plugin endpoints lacking valid _wpnonce parameters

Detection Strategies

Audit WordPress database tables (wp_options, wp_postmeta) for HTML or JavaScript content in fields owned by the plugin
Review web server access logs for cross-origin POST requests to plugin admin URLs with Referer headers from external domains
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to wp-admin without valid nonce parameters

Monitoring Recommendations

Enable WordPress audit logging to track plugin setting changes and content modifications by administrator accounts
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on admin pages
Alert on administrator session activity originating from atypical IP addresses or user-agent strings

How to Mitigate CVE-2024-51641

Immediate Actions Required

Deactivate and remove the Advanced PDF Generator plugin until a patched version above 0.4.0 is confirmed available
Review all plugin-managed content and settings for injected scripts and remove any unauthorized entries
Force a password reset and session invalidation for all WordPress administrator accounts
Apply a WAF rule blocking cross-origin POST requests to wp-admin endpoints without valid nonces

Patch Information

No fixed version is identified in the NVD record at the time of publication. The vulnerability affects all versions through 0.4.0. Administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for patch availability before re-enabling the plugin.

Workarounds

Remove the advanced-pdf-generator plugin directory from wp-content/plugins/ if the plugin is not business-critical
Restrict access to /wp-admin/ paths by source IP using web server access controls or VPN-only administrator access
Implement a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Require administrators to use separate browsers or browser profiles for WordPress management

bash

# Configuration example: Nginx restriction limiting wp-admin to a trusted IP range
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}