CVE-2024-52477 Overview
CVE-2024-52477 is a Cross-Site Request Forgery (CSRF) vulnerability in the docxpresso Document & Data Automation WordPress plugin. The flaw chains a missing CSRF protection [CWE-352] with insufficient input sanitization, enabling Stored Cross-Site Scripting (XSS) when an authenticated administrator visits an attacker-controlled page. Affected versions include document-data-automation from initial release through version 1.6.1. Successful exploitation requires user interaction but no privileges from the attacker, since the victim's authenticated session performs the privileged write. Stored payloads execute in the browsers of subsequent site users, including administrators.
Critical Impact
An unauthenticated remote attacker can persist malicious JavaScript in plugin-managed content by tricking an authenticated administrator into visiting a crafted page, leading to session theft, account takeover, or further site compromise.
Affected Products
- docxpresso Document & Data Automation plugin for WordPress
- All versions from initial release through 1.6.1
- WordPress sites where the document-data-automation plugin is installed and active
Discovery Timeline
- 2024-12-02 - CVE-2024-52477 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-52477
Vulnerability Analysis
The vulnerability combines two distinct weaknesses in the Document & Data Automation plugin. First, a state-changing request handler does not validate a CSRF token or origin, allowing forged requests issued by an authenticated user's browser to succeed. Second, the same handler stores user-supplied content without sufficient output encoding or input sanitization, persisting script payloads in the database.
When an administrator with an active WordPress session visits an attacker-controlled page, that page issues a cross-origin request that the browser silently authenticates with the administrator's cookies. The plugin accepts the request and stores attacker-controlled markup. The stored payload then runs whenever a user views the affected resource within WordPress.
Root Cause
The root cause is missing CSRF protection [CWE-352] on a privileged endpoint combined with inadequate sanitization of stored input. WordPress provides nonce-based CSRF defenses via wp_nonce_field() and check_admin_referer(), but the affected handler does not enforce these checks. Stored content also bypasses functions such as wp_kses_post() that would otherwise strip dangerous HTML and JavaScript.
Attack Vector
The attack vector is network-based and requires user interaction from a victim who holds elevated privileges in WordPress. The attacker hosts a crafted HTML page containing a hidden form or fetch() request targeting the vulnerable plugin endpoint. When an authenticated administrator visits this page, the browser submits the request with valid session cookies, and the plugin stores the malicious payload. No exploit code is publicly available at the time of writing, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-52477
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: strings present in plugin-managed records or post content
- WordPress administrator accounts created, modified, or elevated outside of change windows
- Outbound requests from administrator browsers to unfamiliar domains shortly after visiting external links
- New or modified files in wp-content/plugins/document-data-automation/ not matching the installed version hash
Detection Strategies
- Inspect HTTP access logs for POST requests to plugin endpoints lacking a valid Referer from the WordPress admin domain
- Query the WordPress database for stored fields containing HTML event handlers or <script tags within plugin tables
- Monitor for administrator session activity originating from pages hosted on third-party domains
Monitoring Recommendations
- Enable WordPress audit logging to capture configuration and content changes performed by privileged users
- Forward web server and WordPress logs to a centralized analytics platform for correlation across browser, session, and request data
- Alert on creation of new users with administrator or editor roles
How to Mitigate CVE-2024-52477
Immediate Actions Required
- Update the Document & Data Automation plugin to a version later than 1.6.1 as soon as the vendor publishes a fixed release
- If no patched version is available, deactivate and remove the plugin until a fix ships
- Force a password reset and session invalidation for all WordPress administrator accounts
- Audit plugin-managed content and posts for injected scripts and remove malicious entries
Patch Information
The vulnerability affects Document & Data Automation versions through 1.6.1. Consult the Patchstack Vulnerability Report for the latest vendor patch status and upgrade guidance.
Workarounds
- Restrict access to /wp-admin/ by IP allow-list at the web server or WAF layer to reduce CSRF exposure
- Deploy a Web Application Firewall rule that blocks requests to the plugin endpoint missing a same-origin Referer header
- Apply a strict Content-Security-Policy response header to limit execution of injected inline scripts
- Train administrators to log out of WordPress before browsing untrusted external sites
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
