CVE-2024-51652 Overview
CVE-2024-51652 is a Cross-Site Request Forgery (CSRF) vulnerability in the marckocher Skip To WordPress plugin. The flaw affects all versions of skip-to up to and including 2.0.0. Exploitation allows an unauthenticated attacker to force an authenticated administrator to submit a forged request that stores malicious JavaScript in the plugin configuration, resulting in Stored Cross-Site Scripting (XSS). The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
A successful attack chains CSRF with Stored XSS, enabling script execution in administrator browsers, session theft, account takeover, and persistent injection of malicious content into WordPress sites running the Skip To plugin.
Affected Products
- marckocher Skip To plugin for WordPress
- Skip To versions from n/a through <= 2.0.0
- WordPress installations using the skip-to plugin
Discovery Timeline
- 2024-11-19 - CVE-2024-51652 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51652
Vulnerability Analysis
The Skip To plugin fails to validate the origin of state-changing requests to its administrative endpoints. An authenticated administrator visiting an attacker-controlled page can be silently coerced into submitting a request that updates plugin settings. Because the affected settings fields are rendered back into pages without proper output encoding, the injected payload persists as Stored XSS.
The attack requires user interaction, since an administrator must load or click content prepared by the attacker. Once the payload is stored, it executes in the browser context of every visitor or administrator who loads the affected page, allowing session hijacking, privilege abuse through the WordPress REST API, and further site compromise.
The vulnerability sits at the intersection of two weaknesses: missing anti-CSRF tokens (or nonce verification) on plugin configuration handlers, and insufficient sanitization of user-supplied input rendered in HTML contexts.
Root Cause
The root cause is the absence of proper CSRF protection on the Skip To plugin's settings update handler. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose, but the vulnerable handler either omits the check or accepts requests without validating a nonce. Combined with unsanitized storage of plugin option values, the missing check permits attacker-controlled scripts to be persisted through a forged administrator request.
Attack Vector
The attack is delivered over the network and requires that an authenticated WordPress administrator interact with attacker-controlled content, such as a crafted link, image, or HTML page. The attacker hosts a page that auto-submits a form to the plugin's settings endpoint using the administrator's active session cookies. The forged request writes a malicious <script> payload into a Skip To option that is later rendered without encoding, producing persistent Stored XSS on the site.
No verified public exploit code is available. See the Patchstack WordPress Vulnerability Report for advisory details.
Detection Methods for CVE-2024-51652
Indicators of Compromise
- Unexpected <script>, onerror, or onload content stored in Skip To plugin options within the wp_options table.
- Outbound requests from visitor or administrator browsers to unfamiliar domains after loading pages that render Skip To output.
- Administrator sessions initiating settings changes to the skip-to plugin without a corresponding admin UI interaction in access logs.
Detection Strategies
- Review the wp_options table for entries associated with the skip-to plugin and inspect values for HTML or JavaScript content.
- Correlate WordPress admin-ajax and options.php POST requests with HTTP Referer headers that do not originate from the site's own admin interface.
- Scan rendered pages for injected script tags in areas controlled by the Skip To plugin using automated web content integrity checks.
Monitoring Recommendations
- Enable WordPress audit logging to record plugin settings changes with source IP, user, and referrer metadata.
- Alert on administrator-initiated POST requests to Skip To settings endpoints from external referrers.
- Monitor Content Security Policy (CSP) violation reports for inline script executions on pages using the plugin.
How to Mitigate CVE-2024-51652
Immediate Actions Required
- Deactivate the Skip To plugin on any WordPress site running version 2.0.0 or earlier until a patched release is confirmed installed.
- Audit the wp_options table and plugin-controlled content for any stored scripts and remove malicious payloads.
- Force password resets and session invalidation for all administrator accounts that may have visited untrusted content while logged in.
Patch Information
At the time of publication, the advisory lists all versions through 2.0.0 as affected. Administrators should consult the Patchstack advisory for the latest fixed version guidance and apply updates as soon as the vendor publishes a patched release.
Workarounds
- Remove the skip-to plugin directory from wp-content/plugins/ if a patched version is not yet available.
- Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit CSRF exposure for administrators.
- Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of Stored XSS if exploitation occurs.
- Require administrators to use a dedicated browser profile or session for WordPress administration to prevent cross-site request reuse.
# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate skip-to
wp plugin delete skip-to
# Example: search wp_options for suspicious script content
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%skip%to%' AND option_value LIKE '%<script%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
