CVE-2024-53779 Overview
CVE-2024-53779 is a Cross-Site Request Forgery (CSRF) vulnerability in the 8bitkid Yahoo! WebPlayer (yahoo-media-player) WordPress plugin. The flaw affects all plugin versions up to and including 2.0.6. An attacker can chain the CSRF flaw with a Stored Cross-Site Scripting (XSS) condition, leading to persistent script execution in the context of an administrator session.
The weakness is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, typically an authenticated administrator visiting an attacker-controlled page.
Critical Impact
Successful exploitation lets an unauthenticated attacker inject persistent JavaScript into the WordPress site, enabling session theft, content manipulation, and lateral compromise of administrative functions.
Affected Products
- 8bitkid Yahoo! WebPlayer (yahoo-media-player) WordPress plugin
- All versions from n/a through 2.0.6
- WordPress installations using the affected plugin
Discovery Timeline
- 2024-12-02 - CVE-2024-53779 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-53779
Vulnerability Analysis
The Yahoo! WebPlayer plugin exposes one or more state-changing endpoints that do not validate a CSRF nonce. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose, but the plugin omits these checks on requests that modify stored plugin data. As a result, a forged request originating from an attacker-controlled site executes with the privileges of the authenticated victim.
Because the affected request handler also fails to sanitize and escape user-supplied input, the attacker's payload is written verbatim to the database. The stored payload then renders within plugin output, producing a Stored XSS condition. The composite CSRF-to-Stored-XSS chain elevates the impact from a single-session compromise to a persistent foothold affecting every visitor to the affected page.
Root Cause
The root cause is the absence of anti-CSRF token validation on plugin administrative actions, combined with insufficient input sanitization on the same endpoint. Output is not escaped using esc_html(), esc_attr(), or equivalent context-aware encoding before being emitted to the browser.
Attack Vector
An attacker hosts a malicious page containing an auto-submitting form or fetch() call targeting the vulnerable plugin endpoint. When a logged-in administrator visits the page, the browser attaches WordPress authentication cookies to the forged request. The plugin processes the request and persists the attacker's JavaScript payload. The payload then executes for every subsequent visitor who loads the affected content.
For technical specifics, see the PatchStack WordPress Vulnerability Advisory.
Detection Methods for CVE-2024-53779
Indicators of Compromise
- Unexpected <script> tags, onerror=, or onload= handlers embedded in posts, pages, or plugin-managed content.
- Outbound HTTP requests from visitor browsers to unfamiliar domains tied to credential or session exfiltration.
- Modifications to plugin options or post metadata that do not correspond to a legitimate administrator action in the audit log.
Detection Strategies
- Audit the WordPress database (wp_posts, wp_postmeta, wp_options) for HTML or JavaScript artifacts associated with the plugin.
- Inspect web server access logs for POST requests to plugin endpoints lacking a valid Referer header from the same origin.
- Monitor for administrator actions that occur immediately after the administrator visits an external site.
Monitoring Recommendations
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts.
- Forward WordPress audit logs to a centralized SIEM for correlation against browsing telemetry.
- Alert on the creation or modification of plugin-controlled content outside business hours or from unusual IP addresses.
How to Mitigate CVE-2024-53779
Immediate Actions Required
- Disable or remove the Yahoo! WebPlayer (yahoo-media-player) plugin until a patched version is confirmed available.
- Rotate WordPress administrator passwords and invalidate active sessions using wp_destroy_all_sessions().
- Review all plugin-managed content and remove any injected scripts or unexpected HTML.
Patch Information
No vendor patch is referenced in the published advisory. Affected versions are documented as n/a through <= 2.0.6. Administrators should consult the PatchStack WordPress Vulnerability Advisory for the latest remediation status and migrate to an actively maintained media player plugin if no fix is released.
Workarounds
- Restrict access to /wp-admin/ by source IP using web server ACLs or a WAF rule set.
- Enforce SameSite=Strict or SameSite=Lax on the WordPress authentication cookies to mitigate cross-site request delivery.
- Apply a strict Content Security Policy that disallows inline scripts and untrusted external sources.
- Require administrators to use a dedicated browser profile for WordPress administration to limit cross-origin cookie exposure.
# Disable the affected plugin via WP-CLI
wp plugin deactivate yahoo-media-player
wp plugin delete yahoo-media-player
# Invalidate active sessions for all users
wp eval 'foreach (get_users() as $u) { WP_Session_Tokens::get_instance($u->ID)->destroy_all(); }'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
