CVE-2024-53780: Load More Posts CSRF Vulnerability

CVE-2024-53780 Overview

CVE-2024-53780 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the rajeevglocify Load More Posts plugin for WordPress. The flaw chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious scripts through forged authenticated requests. The vulnerability affects all versions of Load More Posts up to and including 1.5.0. Successful exploitation requires user interaction, such as an administrator clicking a crafted link while authenticated to the WordPress site. Once exploited, attackers can inject JavaScript that executes in the browser of any user viewing the affected pages.

Critical Impact
Attackers can persist malicious JavaScript on WordPress sites running vulnerable Load More Posts installations, enabling session theft, defacement, and pivoting to administrative compromise.

Affected Products

rajeevglocify Load More Posts plugin for WordPress
All versions from n/a through 1.5.0
WordPress sites with the load-more-posts plugin installed and active

Discovery Timeline

2024-12-02 - CVE-2024-53780 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53780

Vulnerability Analysis

The vulnerability combines two weaknesses into a single exploit chain. The Load More Posts plugin processes state-changing requests without validating an anti-CSRF token (nonce). The same request handlers also fail to sanitize or encode user-supplied input before persisting it to the WordPress database.

An attacker hosts a malicious page containing a forged request targeting a plugin endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the request using the administrator's session cookies. The plugin accepts the request as legitimate and stores the attacker's payload, which later executes as JavaScript when rendered in a browser.

Root Cause

The root cause is a missing CSRF token verification in the plugin's request handlers, classified under CWE-352. WordPress provides wp_nonce_field() and check_admin_referer() functions for CSRF protection, but the vulnerable handlers do not invoke these checks. The absence of output encoding on stored values compounds the issue, transforming a CSRF flaw into a persistent XSS condition.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically an authenticated administrator clicking a link or loading a page controlled by the attacker. The scope is changed, meaning the injected script can affect other users beyond the attacker's privilege level. The vulnerability has an EPSS score of 0.152%, placing it in the 4.7 percentile for likelihood of exploitation in the wild.

The attack mechanism is described in detail in the Patchstack WordPress Vulnerability advisory. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2024-53780

Indicators of Compromise

Unexpected <script> tags, event handlers, or obfuscated JavaScript stored within plugin-managed database tables or post meta fields
WordPress access logs showing POST requests to Load More Posts endpoints with Referer headers from external or unrelated domains
New or modified administrator accounts created shortly after an admin session interacted with an external link
Browser console errors or unexpected redirects when loading pages that use the Load More Posts shortcode

Detection Strategies

Inspect the wp_options, wp_postmeta, and plugin-specific tables for HTML or JavaScript payloads in fields expected to hold plain text or numeric values
Audit installed plugin versions across WordPress estates and flag any instance of load-more-posts at version 1.5.0 or earlier
Correlate admin-area POST requests with the HTTP_REFERER header to identify requests originating outside the WordPress administrative interface

Monitoring Recommendations

Forward WordPress access and audit logs to a centralized SIEM and alert on plugin configuration changes outside expected maintenance windows
Monitor outbound traffic from web servers for connections to attacker-controlled domains that may receive exfiltrated session tokens
Deploy a web application firewall (WAF) rule to flag requests to plugin endpoints lacking a valid WordPress nonce parameter

How to Mitigate CVE-2024-53780

Immediate Actions Required

Identify all WordPress sites running the Load More Posts plugin at version 1.5.0 or earlier and deactivate the plugin until a fixed release is available
Force a password reset and session invalidation for all WordPress administrators on affected sites
Review stored content and plugin settings for injected scripts and remove any unauthorized payloads
Restrict administrative access to trusted IP ranges using server-level or WAF rules

Patch Information

At the time of publication, the Patchstack advisory lists the vulnerability as affecting Load More Posts versions through 1.5.0 with no patched version specified. Administrators should monitor the Patchstack advisory and the WordPress plugin repository for a vendor-supplied fix and apply it immediately upon release.

Workarounds

Uninstall the Load More Posts plugin and replace its functionality with an actively maintained alternative
Deploy a Content Security Policy (CSP) that restricts inline scripts and limits script sources to trusted origins
Configure a WAF rule to require a valid _wpnonce parameter on POST requests targeting plugin endpoints
Train administrators to log out of WordPress before browsing untrusted sites and to use isolated browser profiles for administrative tasks

bash

# Example WAF rule (ModSecurity) requiring a nonce on plugin POST requests
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1005378,phase:2,deny,status:403,msg:'Load More Posts CSRF protection'"
    SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
        "chain"
        SecRule ARGS:action "@rx ^load_more_posts" \
            "chain"
            SecRule &ARGS:_wpnonce "@eq 0"