CVE-2024-51654 Overview
CVE-2024-51654 is a Cross-Site Request Forgery (CSRF) vulnerability in the Eric Allen APK Downloader WordPress plugin that leads to Stored Cross-Site Scripting (XSS). The flaw affects all plugin versions up to and including 1.0.0. An attacker who tricks an authenticated administrator into visiting a crafted page can submit forged requests that inject persistent JavaScript into plugin-controlled output. The stored payload then executes in the browser of every visitor or administrator who loads the affected page. The issue is tracked under CWE-352.
Critical Impact
Successful exploitation allows attackers to persist malicious JavaScript in a WordPress site through a single forged request, enabling session theft, administrative account takeover, and drive-by client-side attacks against site visitors.
Affected Products
- Eric Allen APK Downloader WordPress plugin
- All versions from initial release through 1.0.0
- WordPress sites with the apk-downloader plugin installed and active
Discovery Timeline
- 2024-11-19 - CVE-2024-51654 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51654
Vulnerability Analysis
The APK Downloader plugin exposes one or more state-changing endpoints that accept input intended to be persisted and later rendered in the WordPress dashboard or front end. These endpoints do not validate a WordPress nonce or verify the request origin. As a result, an attacker can craft an HTML form or image tag on an external site that, when loaded by an authenticated administrator, silently submits a request to the vulnerable endpoint.
Because the submitted input is stored without proper output encoding, the attacker controls JavaScript that executes inside the application context. The chain combines two weaknesses: missing CSRF protection and missing output sanitization. The result is a stored XSS payload delivered without requiring direct attacker authentication.
Root Cause
The root cause is the absence of CSRF token validation on plugin handlers that accept user-supplied content. WordPress provides wp_nonce_field() and check_admin_referer() for this purpose, but the affected plugin handlers do not enforce these checks. Compounding the issue, stored values are emitted in HTML contexts without esc_html(), esc_attr(), or equivalent escaping.
Attack Vector
Exploitation is network-based and requires user interaction from a privileged WordPress user. The attacker hosts a malicious page containing an auto-submitting form targeted at the vulnerable plugin endpoint. When an authenticated administrator visits that page, the browser submits the request with valid session cookies. The malicious payload is stored in the WordPress database and rendered on subsequent page loads, executing in every viewer's browser session. See the Patchstack Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2024-51654
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) in plugin-managed post content or option values.
- Outbound requests from administrator browsers to unknown domains shortly after visiting external links.
- New or modified WordPress administrator accounts created without a corresponding audit log entry.
- Entries in wp_options or plugin-specific tables containing encoded JavaScript payloads (%3Cscript%3E, \\x3cscript).
Detection Strategies
- Inspect HTTP access logs for POST requests to wp-admin/admin.php or plugin endpoints lacking a _wpnonce parameter.
- Scan the WordPress database for stored HTML or JavaScript in fields managed by the apk-downloader plugin.
- Review browser-side Content Security Policy (CSP) violation reports for unexpected inline script execution on admin pages.
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin option changes and the user accounts that made them.
- Forward web server and WordPress audit logs to a centralized SIEM for correlation with administrator authentication events.
- Monitor for newly registered administrator users, role changes, and unexpected modifications to active plugins or themes.
How to Mitigate CVE-2024-51654
Immediate Actions Required
- Deactivate and remove the APK Downloader plugin until a patched version is available, since all releases through 1.0.0 are affected.
- Audit administrator accounts and rotate credentials for any user who may have visited untrusted sites while logged in to WordPress.
- Inspect plugin-managed content and the wp_options table for stored scripts and remove any malicious entries.
- Restrict administrator browsing to trusted sites and require re-authentication for sensitive WordPress actions.
Patch Information
At the time of the last NVD update, no fixed version has been published for the Eric Allen APK Downloader plugin. The vulnerability affects all releases up to and including 1.0.0. Refer to the Patchstack Vulnerability Advisory for vendor status updates.
Workarounds
- Remove the plugin entirely if business requirements do not justify the residual risk.
- Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated or nonce-less POST requests to plugin endpoints.
- Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages.
- Use the SameSite=Strict attribute on authentication cookies to limit cross-origin request forgery from third-party sites.
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate apk-downloader
wp plugin delete apk-downloader
# Verify removal
wp plugin list --status=active | grep -i apk-downloader
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
