CVE-2024-51656: Flash Show And Hide Box CSRF Vulnerability

CVE-2024-51656 Overview

CVE-2024-51656 is a Cross-Site Request Forgery (CSRF) vulnerability in the litefeel Flash Show And Hide Box WordPress plugin. The flaw affects all versions of flash-show-and-hide-box up to and including 1.6. Attackers can chain the CSRF flaw with Stored Cross-Site Scripting (XSS), allowing persistent injection of malicious scripts into the affected WordPress site.

The weakness is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires an authenticated user, typically an administrator, to visit an attacker-controlled page while logged into the vulnerable WordPress site.

Critical Impact
A successful exploit injects persistent JavaScript into the WordPress site, enabling session theft, administrative account takeover, and arbitrary actions against site visitors.

Affected Products

litefeel Flash Show And Hide Box (flash-show-and-hide-box) WordPress plugin
All versions from n/a through 1.6
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-11-19 - CVE-2024-51656 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51656

Vulnerability Analysis

The vulnerability combines two weaknesses into a single attack chain. The plugin's state-changing endpoints lack proper anti-CSRF token validation, accepting forged requests originating from third-party origins. Those same endpoints also fail to sanitize or encode user-supplied input before storing it in the database and rendering it back in the WordPress administrative interface or front-end pages.

An attacker crafts a malicious web page containing a hidden form or JavaScript that submits a forged request to a vulnerable plugin endpoint. When a logged-in WordPress administrator visits the page, the browser automatically attaches valid session cookies. The forged request executes with administrative privileges and stores attacker-controlled JavaScript payloads through the plugin's configuration interface.

The stored payload then executes every time a victim loads a page containing the injected content. This converts a one-time CSRF interaction into persistent script execution affecting all subsequent visitors.

Root Cause

The root cause is the absence of WordPress nonce verification on plugin form handlers. Functions such as wp_verify_nonce() and check_admin_referer() are either missing or improperly implemented. Combined with the absence of output encoding through esc_html(), esc_attr(), or wp_kses(), the plugin permits forged write operations that persist unsanitized script content.

Attack Vector

Exploitation requires user interaction across the network. An attacker hosts a malicious page and lures an authenticated WordPress administrator to visit it through phishing, malvertising, or a compromised site. The browser silently submits the forged request, the plugin processes it as legitimate, and the injected script becomes part of the site's stored content.

No code example is published for this vulnerability. See the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2024-51656

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript URIs stored in Flash Show And Hide Box plugin settings or post content
WordPress administrative actions executed without corresponding admin session activity in access logs
HTTP Referer headers on plugin write endpoints pointing to external domains
New or modified WordPress administrator accounts shortly after admin browsing activity

Detection Strategies

Audit the wp_options table and plugin configuration rows for HTML or JavaScript content where plain text is expected
Review web server access logs for POST requests to plugin endpoints lacking valid nonce parameters
Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to WordPress admin handlers
Inspect rendered pages with a headless browser to identify unexpected script execution

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting changes with originating IP and referrer data
Monitor browser-side telemetry for outbound requests from administrator sessions to unknown domains
Track plugin version inventory across WordPress installations to identify hosts still running version 1.6 or earlier

How to Mitigate CVE-2024-51656

Immediate Actions Required

Deactivate and remove the Flash Show And Hide Box plugin until a patched version is confirmed available from the vendor
Audit plugin configuration data and remove any unauthorized HTML or JavaScript content
Force a password reset for all WordPress administrator accounts and invalidate active sessions
Review recent administrative actions for unauthorized changes to users, themes, or plugins

Patch Information

At the time of NVD publication, no fixed version is listed beyond 1.6. Site operators should consult the Patchstack advisory for current patch status and apply any vendor update immediately upon release.

Workarounds

Remove the plugin entirely if a patched release is not yet available
Restrict access to /wp-admin/ by IP allowlist to reduce the attack surface for CSRF
Deploy a WAF rule that blocks state-changing POST requests to the plugin lacking a same-origin Referer header
Enforce SameSite=Strict or SameSite=Lax on WordPress authentication cookies to break cross-origin request flow

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate flash-show-and-hide-box
wp plugin delete flash-show-and-hide-box