CVE-2024-53776: Donate Me Plugin CSRF Vulnerability

CVE-2024-53776 Overview

CVE-2024-53776 is a Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in the Donate Me WordPress plugin developed by raphaelheide. The flaw affects all versions of the plugin up to and including 1.2.5. An unauthenticated attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the plugin's stored settings. The injected script then executes in the browser of any user who visits the affected page.

Critical Impact
Successful exploitation enables persistent JavaScript execution in administrator and visitor browsers, leading to session theft, account takeover, and arbitrary administrative actions on the WordPress site.

Affected Products

raphaelheide Donate Me WordPress plugin versions through 1.2.5
WordPress installations with the donate-me plugin enabled
Any site administrator session active while the plugin is installed

Discovery Timeline

2024-12-02 - CVE-2024-53776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53776

Vulnerability Analysis

The vulnerability combines two distinct weaknesses into a single exploitation chain. The plugin's settings-handling endpoints lack proper CSRF protection, meaning they do not validate WordPress nonces or verify the origin of state-changing requests. Additionally, input fields processed by these endpoints are not sanitized or output-encoded before being rendered, allowing an attacker to store arbitrary HTML and JavaScript through a forged request. This places the issue under [CWE-352] Cross-Site Request Forgery as the primary classification.

The attack requires user interaction from a privileged account. An administrator must visit an attacker-controlled web page while authenticated to the target WordPress site. The forged request submits malicious payloads to the plugin's configuration, persisting the script in the database. Subsequent page loads render the script and execute it in every viewer's browser, including site visitors and other administrators.

Root Cause

The root cause is the absence of nonce verification on plugin configuration endpoints combined with missing output encoding of stored settings values. WordPress provides the wp_verify_nonce() and check_admin_referer() functions specifically to defend against CSRF, but the Donate Me plugin does not enforce these checks on its state-changing actions through version 1.2.5.

Attack Vector

The attack is delivered over the network and requires no authentication from the attacker. The attacker hosts a malicious HTML page containing an auto-submitting form or fetch request that targets the vulnerable plugin endpoint. When a logged-in WordPress administrator visits the page, the browser automatically attaches the administrator's session cookies to the forged request. The plugin processes the request as legitimate and stores the attacker-supplied JavaScript. Stored payloads then execute whenever the affected plugin page is rendered.

Technical details are documented in the Patchstack WordPress Vulnerability Advisory.

Detection Methods for CVE-2024-53776

Indicators of Compromise

Unexpected <script> tags, event handlers, or obfuscated JavaScript stored within Donate Me plugin options in the wp_options table
Outbound requests from administrator browsers to unfamiliar domains immediately after loading plugin configuration pages
New or modified WordPress administrator accounts created shortly after an admin visited an external link
HTTP POST requests to plugin endpoints lacking a valid _wpnonce parameter in webserver access logs

Detection Strategies

Audit the wp_options table for plugin settings values containing HTML or JavaScript syntax such as <script, onerror=, or javascript:
Review webserver logs for POST requests to donate-me plugin paths originating from cross-origin Referer headers
Use WordPress security scanners that enumerate vulnerable plugin versions and flag installations at or below 1.2.5

Monitoring Recommendations

Enable WordPress audit logging to track changes to plugin settings and administrator activity
Monitor administrator session activity for anomalous requests issued immediately after navigation to external sites
Alert on creation of new privileged accounts or modification of existing administrator roles

How to Mitigate CVE-2024-53776

Immediate Actions Required

Deactivate and remove the Donate Me plugin if a patched version is not yet available from the vendor
Force a password reset for all WordPress administrator accounts and invalidate active sessions
Inspect plugin settings stored in the database and remove any unauthorized HTML or script content

Patch Information

No patched version is identified in the available advisory data. The Patchstack advisory confirms all versions through 1.2.5 are affected. Administrators should monitor the Patchstack WordPress Vulnerability Advisory and the plugin's official repository for updates beyond version 1.2.5.

Workarounds

Remove the plugin entirely until a fixed release is published by the vendor
Restrict administrator access to the WordPress admin dashboard from trusted IP ranges using web server or firewall rules
Deploy a web application firewall rule blocking cross-origin POST requests to donate-me plugin endpoints without a valid _wpnonce token
Train administrators to log out of WordPress sessions before browsing untrusted external sites

bash

# Configuration example: WAF rule blocking cross-origin requests to the plugin
# ModSecurity rule blocking POSTs to donate-me paths missing a same-origin Referer
SecRule REQUEST_METHOD "@streq POST" \
  "id:1005377,phase:1,deny,status:403,\
   chain,msg:'Block CVE-2024-53776 CSRF attempt against donate-me plugin'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=donate-me" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"