CVE-2024-53782: Photo Video Store CSRF Vulnerability

CVE-2024-53782 Overview

CVE-2024-53782 is a Cross-Site Request Forgery (CSRF) vulnerability in the cmsaccount Photo Video Store WordPress plugin that enables Cross-Site Scripting (XSS) attacks. The flaw affects Photo Video Store versions up to and including 21.07. An attacker can craft a malicious request that, when triggered by an authenticated user, injects script content into the plugin's stored or reflected output. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and carries a CVSS v3.1 score of 7.1. The EPSS exploit probability is 0.152%.

Critical Impact
Successful exploitation can execute attacker-controlled JavaScript in a victim's browser, leading to session compromise, account takeover, and content manipulation within the WordPress administrative interface.

Affected Products

cmsaccount Photo Video Store WordPress plugin (photo-video-store)
All versions from initial release through 21.07
WordPress sites running the vulnerable plugin with authenticated administrator sessions

Discovery Timeline

2024-12-02 - CVE-2024-53782 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53782

Vulnerability Analysis

The Photo Video Store plugin fails to validate the origin and authenticity of state-changing requests. Sensitive plugin actions process incoming requests without verifying a WordPress nonce or other anti-CSRF token. An attacker who tricks an authenticated administrator into visiting a malicious page can force the browser to submit a forged request to the WordPress site. Because the plugin trusts the session cookie alone, the forged request executes with the administrator's privileges. The CSRF flaw chains into a stored or reflected XSS condition because user-controlled input from the forged request is rendered without proper output encoding.

Root Cause

The root cause is the absence of CSRF protection mechanisms (CWE-352) on plugin endpoints that accept and persist user input. WordPress provides wp_nonce_field() and check_admin_referer() APIs to mitigate CSRF, but these controls are not enforced on the vulnerable handler. The lack of input sanitization on the same endpoints converts the CSRF primitive into an XSS execution sink.

Attack Vector

Exploitation requires network access and user interaction. An attacker hosts a malicious page containing an auto-submitting form or image tag targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser submits the forged request along with valid session cookies. The plugin processes the request, stores attacker-controlled payload data, and later renders it without encoding. The resulting script executes in the context of the WordPress admin domain, enabling cookie theft, privilege escalation, or persistent backdoor injection. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-53782

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers in Photo Video Store plugin configuration fields, product descriptions, or store settings
WordPress administrator sessions originating from unusual referrers pointing to external attacker-controlled domains
New or modified administrator accounts created shortly after an admin browsing session
Outbound HTTP requests from administrator browsers to unknown domains while editing plugin content

Detection Strategies

Inspect WordPress database tables, including wp_options and wp_postmeta, for HTML entities or script payloads associated with the plugin
Monitor web server access logs for POST requests to plugin endpoints lacking a valid _wpnonce parameter
Deploy a web application firewall ruleset that flags requests to plugin handlers missing Referer or Origin headers matching the site domain

Monitoring Recommendations

Enable WordPress audit logging to capture administrator-initiated configuration changes with full request context
Alert on creation of new administrator accounts or modification of user roles outside of change windows
Track Content Security Policy (CSP) violation reports to identify inline script execution attempts in the admin interface

How to Mitigate CVE-2024-53782

Immediate Actions Required

Deactivate the Photo Video Store plugin until a patched version is installed if the plugin is not business-critical
Audit all WordPress administrator and editor accounts for unauthorized changes since the plugin was last used
Force a password reset and session invalidation for all privileged WordPress users
Review plugin-managed content for injected JavaScript and remove any unauthorized markup

Patch Information

No fixed version is published in the available CVE data. Administrators should consult the Patchstack Vulnerability Report and the plugin vendor's update channel for the latest remediated release beyond version 21.07.

Workarounds

Restrict WordPress admin access to a trusted IP allowlist at the web server or WAF layer
Enforce a strict Content Security Policy that blocks inline scripts and external script sources in the WordPress admin interface
Require administrators to use a dedicated browser profile for WordPress administration to limit cross-site request exposure
Deploy a WAF rule that rejects POST requests to photo-video-store plugin endpoints when the Referer header does not match the site origin

bash

# Example nginx configuration to enforce same-origin Referer on plugin endpoints
location ~* /wp-content/plugins/photo-video-store/ {
    if ($http_referer !~* "^https?://your-wordpress-site\.com/") {
        return 403;
    }
}