CVE-2024-53755: Third Party Cookie Eraser CSRF Vulnerability

CVE-2024-53755 Overview

CVE-2024-53755 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Andrea Pernici Third Party Cookie Eraser plugin for WordPress. The flaw affects all versions up to and including 1.0.2. An attacker can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) payload by tricking an authenticated administrator into visiting a crafted page. Successful exploitation persists attacker-controlled JavaScript in the plugin configuration, which executes in the browser of any user rendering the affected output.

Critical Impact
Authenticated administrators visiting a malicious page can be coerced into saving attacker-supplied JavaScript that executes against site users and other admins, enabling session theft, account takeover, and further site compromise.

Affected Products

Andrea Pernici Third Party Cookie Eraser WordPress plugin (third-party-cookie-eraser)
All versions from initial release through 1.0.2
WordPress sites running the vulnerable plugin with administrator sessions

Discovery Timeline

2024-12-02 - CVE-2024-53755 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-53755

Vulnerability Analysis

The vulnerability combines two distinct weaknesses. The plugin exposes a state-changing administrative action without an anti-CSRF token (such as a WordPress nonce verified through check_admin_referer() or wp_verify_nonce()). It also fails to sanitize or encode user-supplied input before storing and rendering it in plugin settings pages.

An attacker hosts a page containing a forged request that targets the plugin's settings endpoint. When an authenticated administrator visits that page, the browser submits the request using the admin's session cookies. The plugin accepts the forged submission and stores the payload. Because the stored value is later rendered without proper output encoding, the JavaScript executes in the administrative context.

User interaction is required because the attack depends on the victim browsing to a controlled URL. No prior privileges on the target site are needed by the attacker.

Root Cause

The root cause is missing CSRF protection on a settings handler combined with inadequate input validation and output encoding. WordPress provides nonce APIs and sanitization helpers such as sanitize_text_field() and esc_attr(), but the affected handlers in versions <= 1.0.2 do not apply them consistently.

Attack Vector

Exploitation occurs over the network and requires user interaction. The scope is changed, meaning impact extends to components beyond the vulnerable plugin, such as the browsers of users who render the injected script. Confidentiality, integrity, and availability impacts are all rated low individually but compound when the injected script performs privileged actions.

The vulnerability is described in prose only; no verified public proof-of-concept code is referenced in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-53755

Indicators of Compromise

Unexpected <script> tags, event handlers, or external script src references stored in Third Party Cookie Eraser plugin options within the wp_options table
WordPress administrator accounts created or modified shortly after an admin session interacted with an external link
Outbound requests from admin browsers to unknown domains after loading plugin settings pages

Detection Strategies

Inspect plugin option rows for HTML or JavaScript content using a SQL query such as SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%cookie_eraser%'
Review web server access logs for POST requests to plugin administrative endpoints lacking a Referer header from the same origin or missing a valid nonce parameter
Hunt for browser-side script execution anomalies on /wp-admin/ pages using web application firewall telemetry

Monitoring Recommendations

Alert on modifications to plugin settings outside of approved change windows
Forward WordPress audit logs and web server logs into a centralized data lake for cross-source correlation of CSRF and XSS indicators
Track creation of new administrator accounts and changes to user roles in near real time

How to Mitigate CVE-2024-53755

Immediate Actions Required

Update the Third Party Cookie Eraser plugin to a version newer than 1.0.2 once the vendor publishes a fix, or deactivate and remove the plugin if no patch is available
Audit current plugin settings and remove any unrecognized HTML or JavaScript content from stored options
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

No fixed version is recorded in the available references. The Patchstack Vulnerability Report lists versions through 1.0.2 as affected. Monitor the WordPress plugin repository for an updated release.

Workarounds

Remove or deactivate the Third Party Cookie Eraser plugin until a patched version is released
Enforce a Content Security Policy (CSP) that restricts inline script execution in the /wp-admin/ interface
Require administrators to use isolated browser profiles or sessions when managing WordPress to reduce CSRF exposure
Deploy a web application firewall rule that blocks state-changing POST requests to plugin endpoints when a valid WordPress nonce parameter is absent

bash

# Disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate third-party-cookie-eraser
wp plugin delete third-party-cookie-eraser