CVE-2024-51645 Overview
CVE-2024-51645 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeFuse Maintenance Mode WordPress plugin. The flaw affects all versions of themefuse-maintenance-mode up to and including 1.1.3. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious JavaScript in the plugin's stored settings. The weakness maps to [CWE-352] Cross-Site Request Forgery. An attacker tricks an authenticated administrator into visiting a crafted page, which submits a forged request that writes attacker-controlled script content into the plugin configuration. The injected payload then executes in the context of any user who loads the affected page.
Critical Impact
Authenticated administrators visiting attacker-controlled pages can be coerced into storing persistent JavaScript payloads that execute in browsers of subsequent visitors, enabling session theft, account takeover, and further site compromise.
Affected Products
- ThemeFuse Maintenance Mode plugin for WordPress, versions up to and including 1.1.3
- WordPress sites running the themefuse-maintenance-mode plugin
- Administrator accounts authenticated to vulnerable installations
Discovery Timeline
- 2024-11-19 - CVE-2024-51645 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51645
Vulnerability Analysis
The plugin exposes one or more administrative actions that modify stored settings without validating a CSRF token. WordPress provides nonce primitives such as wp_nonce_field() and check_admin_referer() to bind state-changing requests to the originating session. The vulnerable handler omits this check, so any request carrying a valid administrator cookie is processed. The same handler does not sanitize or escape script-bearing input before persistence. As a result, an attacker who induces an admin to load a malicious page can trigger a forged POST request that writes arbitrary HTML and JavaScript into plugin options. The stored payload then renders in administrative or front-end views, producing Stored XSS. User interaction is required, which is reflected in the attack vector. Impact spans confidentiality, integrity, and availability at limited scope, with a scope change because injected script runs in the victim browser security context.
Root Cause
The root cause is missing CSRF protection on a settings-write endpoint combined with absent output encoding of stored values. Two defects compound: lack of nonce verification on the request handler, and lack of contextual escaping when rendering the stored configuration.
Attack Vector
Exploitation requires an authenticated WordPress administrator to visit an attacker-controlled web page. The page issues a cross-origin form submission or automatic request to the vulnerable plugin endpoint. The forged request writes JavaScript into a stored plugin option. When the affected setting is rendered, the script executes in any visitor's browser. No credentials are required from the attacker, only social engineering of a privileged user.
No verified exploit code is publicly available. Refer to the Patchstack Vulnerability Report for additional technical detail.
Detection Methods for CVE-2024-51645
Indicators of Compromise
- Unexpected <script>, onerror, or onload content stored in plugin option rows within the wp_options table for themefuse-maintenance-mode keys.
- Administrator sessions issuing POST requests to plugin settings endpoints with Referer headers from external domains.
- New or modified administrator accounts, theme files, or plugins created shortly after a maintenance-mode settings change.
Detection Strategies
- Inspect WordPress database option values associated with the plugin for HTML tags, JavaScript event handlers, or encoded payloads such as javascript:, String.fromCharCode, or base64 blobs.
- Review web server access logs for POST requests to wp-admin/admin.php or admin-post.php with the plugin's action parameter and an off-site Referer.
- Correlate browser-side errors and Content Security Policy violation reports against pages rendered by the maintenance-mode plugin.
Monitoring Recommendations
- Alert on file integrity changes within wp-content/plugins/themefuse-maintenance-mode/ and on writes to plugin option keys.
- Monitor administrator authentication events and pair them with outbound HTTP requests from admin browser sessions to untrusted domains.
- Track plugin version inventory across WordPress estates and flag any host still running version 1.1.3 or earlier.
How to Mitigate CVE-2024-51645
Immediate Actions Required
- Disable the ThemeFuse Maintenance Mode plugin on any site running version 1.1.3 or earlier until a patched release is installed.
- Audit stored plugin settings for injected HTML or JavaScript and remove any unauthorized content.
- Rotate administrator credentials and invalidate active sessions if exploitation is suspected.
Patch Information
No fixed version is listed in the NVD record at the time of writing. Consult the Patchstack Vulnerability Report and the vendor's plugin page for the latest update. Apply any release newer than 1.1.3 once published, and verify the changelog references CSRF and XSS fixes.
Workarounds
- Restrict administrative access to known IP ranges using a web application firewall or .htaccess rules on wp-admin.
- Deploy a WAF ruleset that enforces same-origin Referer and Origin checks on WordPress admin POST endpoints.
- Train administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for admin work.
- Apply a strict Content Security Policy that blocks inline scripts on rendered plugin output where feasible.
# Temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate themefuse-maintenance-mode
# Confirm plugin status and installed version
wp plugin get themefuse-maintenance-mode --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
