CVE-2024-53762: FastBook CSRF and Stored XSS Vulnerability

CVE-2024-53762 Overview

CVE-2024-53762 is a Cross-Site Request Forgery (CSRF) vulnerability in the FasterThemes FastBook WordPress plugin, identified as fastbook-responsive-appointment-booking-and-scheduling-system. The flaw allows an unauthenticated attacker to chain CSRF with Stored Cross-Site Scripting (XSS), persisting malicious JavaScript in plugin settings. The vulnerability affects all FastBook plugin versions up to and including 1.1. The weakness is tracked under [CWE-352] (Cross-Site Request Forgery).

Critical Impact

A successful attack tricks an authenticated administrator into submitting a forged request that injects persistent JavaScript, enabling session theft, account takeover, and full site compromise.

Affected Products

• FasterThemes FastBook plugin for WordPress
• All versions from n/a through <= 1.1
• WordPress sites running fastbook-responsive-appointment-booking-and-scheduling-system

Discovery Timeline

• 2024-12-02 - CVE-2024-53762 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53762

Vulnerability Analysis

The FastBook plugin processes administrative state-changing requests without verifying a valid anti-CSRF token. An attacker can host a malicious page that automatically submits a forged request to the plugin's settings endpoint. When a logged-in WordPress administrator visits that page, the browser submits authenticated cookies alongside attacker-controlled payload data.

Because the same endpoint also fails to sanitize or encode user-supplied input, the forged request stores attacker JavaScript in the plugin's database fields. The payload then renders on plugin pages whenever an administrator or end user loads them, transforming a single CSRF request into a Stored XSS persistence mechanism.

The combined exploitation path requires user interaction, consistent with the CVSS vector indicating user interaction is required and scope changes when the script executes in the browser context.

Root Cause

The root cause is the absence of WordPress nonce validation (wp_verify_nonce / check_admin_referer) on plugin form handlers, combined with missing output encoding on stored settings values. Both defects are required for the attack chain to succeed.

Attack Vector

The attack is network-based and requires an authenticated administrator to visit an attacker-controlled URL. The malicious page issues a cross-origin form submission to the WordPress admin endpoint exposed by FastBook. Once stored, the injected script executes in the context of the WordPress site origin, allowing cookie theft, privileged AJAX calls, and persistent backdoor creation.

No verified public proof-of-concept code is available. Technical details are documented in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2024-53762

Indicators of Compromise

• Unexpected <script>, onerror=, or onload= strings stored in FastBook plugin option rows within the wp_options table
• Administrator browser sessions issuing outbound requests to unfamiliar domains shortly after loading WordPress admin pages
• New or modified WordPress administrator accounts created without a corresponding audit log entry
• Referrer headers showing administrators arriving at FastBook admin endpoints from external, untrusted origins

Detection Strategies

• Inspect plugin settings stored in the database for HTML or JavaScript content that should contain only plain text values
• Review web server access logs for POST requests to FastBook admin handlers lacking a same-origin Referer header
• Deploy WordPress security plugins or Web Application Firewall (WAF) rules that flag form submissions missing valid nonce parameters

Monitoring Recommendations

• Alert on modifications to WordPress plugin option rows outside scheduled maintenance windows
• Monitor administrator browser traffic for anomalous JavaScript execution and cross-origin data exfiltration
• Track plugin file integrity and the inventory of installed plugin versions across managed WordPress sites

How to Mitigate CVE-2024-53762

Immediate Actions Required

• Deactivate and remove the FastBook plugin if a patched release is not available for your installed version
• Audit wp_options and FastBook-specific tables for injected script content and remove malicious payloads
• Force a password reset for all WordPress administrator accounts and invalidate active sessions
• Review recently created users, themes, and plugins for unauthorized changes introduced through the XSS payload

Patch Information

No fixed version is identified in the available advisory. The vulnerability affects FastBook through version 1.1. Consult the Patchstack WordPress Vulnerability Report for the current remediation status and migrate to an actively maintained appointment booking plugin if no patch is published.

Workarounds

• Restrict access to /wp-admin/ by source IP using web server or WAF rules to reduce CSRF exposure
• Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies
• Require administrators to use a dedicated browser profile for WordPress administration to limit cross-site request risk
• Deploy a Content Security Policy (CSP) that blocks inline scripts and unauthorized script origins on WordPress admin pages

# Configuration example: block FastBook admin POSTs without same-origin Referer (nginx)
location ~ ^/wp-admin/admin\.php$ {
    if ($request_method = POST) {
        set $block 1;
    }
    if ($http_referer ~* "^https?://your-site\.example/") {
        set $block 0;
    }
    if ($block = 1) {
        return 403;
    }
}