CVE-2024-53716: WP Auto Top CSRF Vulnerability

CVE-2024-53716 Overview

CVE-2024-53716 is a Cross-Site Request Forgery (CSRF) vulnerability in the wp-auto-top WordPress plugin by overtrue. The flaw allows an attacker to trick an authenticated administrator into submitting a forged request that stores malicious JavaScript in the plugin's settings. The stored payload then executes in the browser of any user who loads the affected page. The issue is tracked under CWE-352 and affects all versions of wp-auto-top up to and including 2.9.3.

Critical Impact
A successful attack chains CSRF with Stored Cross-Site Scripting (XSS), enabling attackers to execute arbitrary script in administrator sessions and potentially take over WordPress sites.

Affected Products

WordPress plugin wp-auto-top versions through 2.9.3
Vendor: overtrue
Sites running any WordPress installation with the vulnerable plugin active

Discovery Timeline

2024-12-02 - CVE-2024-53716 published to the National Vulnerability Database (NVD)
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-53716

Vulnerability Analysis

The wp-auto-top plugin adds a "back to top" button to WordPress sites and exposes administrative settings through the wp-admin interface. The vulnerability stems from missing or insufficient anti-CSRF protection on the form handler that processes setting updates. Without a validated nonce, the plugin accepts state-changing requests originating from any cross-origin context.

When chained with insufficient output encoding, the attacker-controlled input persists as Stored XSS. Any administrator visiting the configuration page triggers execution of the injected payload. The attack falls under the Web Application Vulnerability category, combining CSRF (CWE-352) with Stored XSS as the downstream impact.

Root Cause

The root cause is the absence of proper request authenticity verification in the plugin's settings handler. WordPress provides wp_nonce_field() and check_admin_referer() for this purpose, but the vulnerable versions either omit these checks or fail to validate them. Coupled with unsanitized storage of user-supplied values, the missing nonce check allows the CSRF-to-XSS chain.

Attack Vector

The attack is network-based and requires user interaction from a privileged WordPress user. An attacker hosts a malicious page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint. When an authenticated administrator visits the page, the browser sends the forged request along with valid session cookies. The plugin processes the request and stores the attacker's JavaScript payload. The payload then executes whenever the settings page is rendered. See the Patchstack WordPress Vulnerability advisory for additional technical details.

Detection Methods for CVE-2024-53716

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers present in wp-auto-top plugin options stored in the wp_options table
WordPress administrator accounts created or modified shortly after a settings change to the plugin
Outbound HTTP requests from administrator browsers to unfamiliar domains when loading wp-admin pages
Modifications to plugin settings without a corresponding entry in administrator activity logs

Detection Strategies

Inspect the wp_options table for wp-auto-top related keys containing HTML or JavaScript markup
Review web server access logs for POST requests to the plugin's admin endpoint originating with a cross-origin Referer header
Audit installed WordPress plugins and confirm wp-auto-top is upgraded beyond version 2.9.3

Monitoring Recommendations

Enable WordPress audit logging to record plugin setting changes and administrator session activity
Deploy a Web Application Firewall (WAF) with rules that flag cross-origin POSTs to wp-admin endpoints
Monitor browser-side Content Security Policy (CSP) violation reports for unexpected inline script execution in wp-admin

How to Mitigate CVE-2024-53716

Immediate Actions Required

Update the wp-auto-top plugin to a version later than 2.9.3 once a fixed release is available from the vendor
If no patched version exists, deactivate and remove the plugin from all WordPress installations
Force a password reset for all administrator accounts and invalidate active sessions
Inspect plugin settings and remove any injected script content from the database

Patch Information

At the time of publication, the advisory lists all versions through 2.9.3 as affected. Site operators should monitor the Patchstack advisory and the plugin's repository for a remediated build. Apply updates through the WordPress admin dashboard or via WP-CLI as soon as a fix is released.

Workarounds

Restrict access to /wp-admin/ by source IP using web server access controls
Require administrators to use isolated browser profiles when managing WordPress to limit CSRF exposure
Enforce a strict Content Security Policy that blocks inline scripts in the WordPress admin area
Replace wp-auto-top with an alternative "back to top" plugin that maintains active security maintenance

bash

# Remove the vulnerable plugin using WP-CLI
wp plugin deactivate wp-auto-top
wp plugin uninstall wp-auto-top

# Verify removal
wp plugin list | grep wp-auto-top