CVE-2024-51643: Amazon Associate Filter CSRF Vulnerability

CVE-2024-51643 Overview

CVE-2024-51643 is a Cross-Site Request Forgery (CSRF) vulnerability in the ragaskar Amazon Associate Filter WordPress plugin (amazon-associate-filter) that allows attackers to achieve Stored Cross-Site Scripting (XSS). The flaw affects all versions of the plugin up to and including 0.4. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the plugin's stored settings. The injected payload then executes in the browsers of users who later view affected pages. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A single click by an authenticated WordPress administrator on a malicious link can result in persistent JavaScript execution in the WordPress site, enabling session hijacking, content manipulation, or further administrative compromise.

Affected Products

ragaskar Amazon Associate Filter WordPress plugin
Plugin slug: amazon-associate-filter
Versions: from n/a through <= 0.4

Discovery Timeline

2024-11-19 - CVE-2024-51643 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51643

Vulnerability Analysis

The Amazon Associate Filter plugin exposes administrative actions that change plugin settings without verifying request authenticity. The plugin fails to validate anti-CSRF tokens (nonces) on state-changing requests and does not sanitize values stored in plugin options. An attacker chains these two weaknesses to perform a CSRF-to-Stored-XSS attack against the WordPress administrator.

When an authenticated administrator visits an attacker-controlled page, the browser automatically submits a forged request to the vulnerable plugin endpoint. The request writes attacker-supplied JavaScript into a plugin setting. The payload is then rendered without proper output encoding wherever the plugin displays the stored value, resulting in persistent script execution in the context of the WordPress site.

See the Patchstack advisory for full technical details.

Root Cause

The root cause is the absence of CSRF protection on settings-update handlers in amazon-associate-filter. WordPress provides wp_nonce_field() and check_admin_referer() to bind state-changing actions to a verified user session, but the plugin's handlers do not invoke these checks. Compounding this, user-controlled setting values are stored and later rendered without contextual output escaping such as esc_attr() or esc_html().

Attack Vector

Exploitation requires user interaction, specifically an authenticated administrator visiting a malicious page or clicking a crafted link. The attacker hosts an HTML page containing an auto-submitting form or image tag that targets the vulnerable plugin endpoint on the victim's WordPress site. Because the administrator's browser carries valid session cookies, the forged request is processed as authentic. Once the malicious value is stored, any visitor or administrator viewing the affected page triggers the stored JavaScript payload.

No proof-of-concept code is published in the referenced advisory; refer to the Patchstack vulnerability database entry for vendor-confirmed details.

Detection Methods for CVE-2024-51643

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in wp_options rows associated with the amazon-associate-filter plugin.
WordPress administrator POST requests to plugin settings endpoints with Referer headers pointing to external or unknown domains.
New or modified administrator accounts created shortly after a settings change to the plugin.
Outbound requests from visitor browsers to attacker-controlled domains originating on pages where the plugin renders content.

Detection Strategies

Audit the wp_options table for plugin-owned keys containing HTML or JavaScript characters such as <, >, onerror=, or javascript:.
Review web server access logs for POST requests to the plugin's admin handlers that lack a same-origin Referer header.
Compare current plugin settings against a known-good baseline to identify unauthorized changes.

Monitoring Recommendations

Enable WordPress audit logging to record administrator actions and option changes in real time.
Forward web server and WordPress logs to a centralized SIEM for correlation of suspicious settings updates with external referrers.
Alert on browser content security policy (CSP) violations reported from pages that render plugin output.

How to Mitigate CVE-2024-51643

Immediate Actions Required

Deactivate and remove the Amazon Associate Filter plugin (amazon-associate-filter) from any WordPress installation running version 0.4 or earlier until a fixed release is available.
Inspect plugin settings stored in wp_options and remove any injected script content.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

At the time of NVD publication, no fixed version of the Amazon Associate Filter plugin is listed. The vulnerability affects all versions up to and including 0.4. Monitor the Patchstack advisory and the WordPress plugin repository for an official update.

Workarounds

Remove the plugin entirely if patching is not possible, as no vendor fix is currently referenced.
Deploy a Web Application Firewall (WAF) rule that enforces same-origin Referer and Origin headers on requests to wp-admin endpoints belonging to the plugin.
Apply a Content Security Policy (CSP) that disallows inline scripts on pages where plugin output is rendered, reducing the impact of stored XSS payloads.
Restrict WordPress administrator browsing habits and require administrators to use isolated browser profiles for site management.

bash

# Identify the vulnerable plugin and disable it via WP-CLI
wp plugin list --name=amazon-associate-filter --fields=name,status,version
wp plugin deactivate amazon-associate-filter
wp plugin delete amazon-associate-filter

# Search wp_options for potentially injected payloads
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_name LIKE '%amazon_associate%' \
  AND (option_value LIKE '%<script%' OR option_value LIKE '%onerror=%');"