CVE-2024-51650: Random Featured Post Plugin CSRF Flaw

CVE-2024-51650 Overview

CVE-2024-51650 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Random Featured Post WordPress plugin developed by scottmydollarplancom. The flaw impacts all versions up to and including 1.1.3. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious JavaScript within the affected WordPress site.

An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, stores attacker-supplied script in the plugin's data. The stored payload then executes in the browser of any user viewing the affected content.

Critical Impact
Attackers can persist arbitrary JavaScript in WordPress sites by tricking authenticated administrators into visiting malicious pages, leading to session theft, account takeover, or further site compromise.

Affected Products

Random Featured Post WordPress plugin (random-featured-post-plugin) by scottmydollarplancom
All versions from initial release through 1.1.3
WordPress installations with the plugin installed and activated

Discovery Timeline

2024-11-19 - CVE-2024-51650 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51650

Vulnerability Analysis

The vulnerability combines two distinct weaknesses in the Random Featured Post plugin. First, plugin endpoints that modify configuration or stored content lack proper CSRF protection, meaning requests are accepted without verification of a valid WordPress nonce. Second, user-supplied input handled by those endpoints is not sanitized or escaped before being stored and later rendered.

This combination enables an attacker to forge state-changing requests on behalf of an authenticated administrator. The forged request writes attacker-controlled markup into plugin storage. When the stored content is rendered in an administrator or visitor browser, the injected script executes in the site's origin.

The scope change indicated by the CVSS vector reflects the cross-origin nature of the impact, where script execution affects components beyond the vulnerable plugin itself. See the Patchstack advisory for additional technical detail.

Root Cause

The root cause is the absence of WordPress nonce validation on state-changing endpoints, combined with insufficient sanitization of input fields before persistence. WordPress provides wp_verify_nonce() and check_admin_referer() to defend against CSRF, and sanitize_text_field() or wp_kses() for input filtering. The plugin does not consistently apply these controls.

Attack Vector

Exploitation requires user interaction from an authenticated WordPress administrator. The attacker hosts a page containing an auto-submitting form or image tag that targets the vulnerable plugin endpoint on the victim's WordPress site. When the administrator visits the page while logged in, the browser sends the forged request with valid session cookies. The plugin processes the request and stores the attacker's XSS payload, which executes on subsequent page loads.

No authentication credentials are required from the attacker. The attack succeeds entirely through the victim's existing session.

Detection Methods for CVE-2024-51650

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in Random Featured Post plugin settings or content fields
Outbound HTTP requests from administrator browsers to unfamiliar domains after visiting external pages
New or modified WordPress administrator accounts created shortly after plugin configuration changes
WordPress audit log entries showing plugin setting changes without a corresponding admin-initiated workflow

Detection Strategies

Inspect the plugin's stored configuration in the WordPress database (wp_options table) for HTML or JavaScript content that should not be present
Review web server access logs for POST requests to plugin endpoints lacking a matching Referer header from the WordPress admin interface
Monitor for administrator session activity originating from unusual IP addresses or user agents shortly after configuration writes

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture all plugin configuration changes with timestamps and user attribution
Deploy a web application firewall rule to flag POST requests to the plugin missing valid _wpnonce parameters
Alert on administrator account logins immediately followed by plugin setting modifications from new geographic locations

How to Mitigate CVE-2024-51650

Immediate Actions Required

Deactivate and remove the Random Featured Post plugin until a patched version is confirmed available from the vendor
Audit plugin configuration data and remove any unexpected scripts or HTML payloads
Force a password reset for all WordPress administrator accounts and invalidate active sessions
Review recent administrator activity for unauthorized plugin or theme installations

Patch Information

At the time of this writing, no fixed version is identified in the NVD record. The advisory indicates all versions up to and including 1.1.3 are affected. Monitor the Patchstack advisory and the WordPress plugin repository for an official update.

Workarounds

Remove the plugin from any production WordPress site until a patched release is available
Restrict access to the WordPress admin interface using IP allowlisting at the web server or firewall layer
Require administrators to use isolated browser profiles or sessions when working in the WordPress admin to reduce CSRF exposure
Deploy a web application firewall with rules to block requests to the plugin's endpoints that lack valid WordPress nonces

bash

# Example: disable the plugin via WP-CLI until a fix is available
wp plugin deactivate random-featured-post-plugin
wp plugin delete random-featured-post-plugin