CVE-2024-53793: eDoc Easy Tables CSRF Vulnerability

CVE-2024-53793 Overview

CVE-2024-53793 is a Cross-Site Request Forgery (CSRF) vulnerability in the eDoc Easy Tables WordPress plugin by jerodmoore. The flaw chains CSRF with Blind SQL Injection, enabling attackers to manipulate database queries through forged requests. The vulnerability affects all versions of edoc-easy-tables up to and including version 1.29. Exploitation requires an authenticated user to interact with attacker-controlled content, but no privileges are required by the attacker. The classification falls under [CWE-352] Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows attackers to execute Blind SQL Injection against the WordPress database by tricking authenticated users into submitting forged requests, leading to data exposure and potential availability impact.

Affected Products

jerodmoore eDoc Easy Tables plugin for WordPress
All versions through 1.29
WordPress sites with the edoc-easy-tables plugin installed

Discovery Timeline

2024-12-02 - CVE-2024-53793 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-53793

Vulnerability Analysis

The vulnerability combines two distinct weaknesses into a single attack chain. The eDoc Easy Tables plugin fails to validate the origin of state-changing requests, omitting proper CSRF token verification on sensitive endpoints. Without anti-CSRF protections, an attacker can craft a malicious page or link that forces an authenticated WordPress user's browser to issue requests to the vulnerable plugin endpoints.

Those endpoints also fail to properly sanitize user-supplied input before incorporating it into SQL queries. This second flaw enables Blind SQL Injection, where the attacker infers database content from response timing or boolean conditions rather than direct output.

The attack requires user interaction, and the impact crosses a security boundary because the forged request executes with the victim's privileges. Confidentiality impact is high, while integrity remains unaffected and availability impact is limited.

Root Cause

The root cause is missing CSRF token validation combined with unsanitized input flowing into SQL statements. The plugin does not enforce WordPress nonce verification via wp_verify_nonce() or check_admin_referer() on the affected actions. Once a request reaches the vulnerable handler, parameters are concatenated into SQL queries without prepared statements or escaping.

Attack Vector

An attacker hosts a malicious web page containing a forged form or image tag targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator or privileged user visits the page, their browser automatically submits the request with valid session cookies. The forged request carries SQL injection payloads in plugin parameters. Because the request originates from an authenticated session, the plugin processes it and the injected SQL executes against the WordPress database. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-53793

Indicators of Compromise

Unexpected POST or GET requests to edoc-easy-tables plugin endpoints originating from external referrers
WordPress access logs showing SQL syntax characters such as ', --, SLEEP(, BENCHMARK(, or UNION SELECT in query parameters
Anomalous database query latency consistent with time-based Blind SQL Injection probing
Authenticated administrator requests with Referer headers pointing to untrusted external domains

Detection Strategies

Inspect web server and WordPress logs for plugin requests lacking valid nonce parameters
Deploy a Web Application Firewall (WAF) rule set targeting CSRF patterns and SQL injection signatures against /wp-admin/admin.php?page=edoc-easy-tables* and related routes
Correlate WordPress audit logs with browser referrer data to flag cross-origin state changes
Monitor MySQL slow query logs for repeated time-delay functions invoked by the WordPress database user

Monitoring Recommendations

Enable WordPress activity logging to record plugin configuration changes and administrative actions
Forward web access logs, database query logs, and WAF events to a centralized SIEM for correlation
Alert on outbound HTTP requests from wp-admin sessions following navigation to untrusted external sites
Track plugin version inventory across WordPress installations to identify hosts still running edoc-easy-tables1.29 or earlier

How to Mitigate CVE-2024-53793

Immediate Actions Required

Disable or uninstall the eDoc Easy Tables plugin until a patched version is confirmed deployed
Restrict administrative access to the WordPress backend using IP allowlisting where feasible
Force logout of all active administrator sessions and rotate WordPress secret keys defined in wp-config.php
Review recent database activity and WordPress user changes for evidence of exploitation

Patch Information

No fixed version is referenced in the available advisory data. The vulnerability affects eDoc Easy Tables through version 1.29. Administrators should consult the Patchstack WordPress Vulnerability Report and the plugin author for updates before reinstalling.

Workarounds

Remove the edoc-easy-tables plugin directory from wp-content/plugins/ to eliminate the attack surface
Deploy a virtual patching rule on the WAF to block requests to the plugin's endpoints lacking a valid WordPress nonce
Require administrators to use a dedicated browser profile for WordPress administration to reduce cross-site request exposure
Enforce SameSite=Strict cookie attributes on WordPress authentication cookies to mitigate cross-origin request forgery

bash

# Configuration example: remove the vulnerable plugin
wp plugin deactivate edoc-easy-tables
wp plugin delete edoc-easy-tables

# Optional: block plugin endpoints at the web server until removal completes
# nginx snippet
location ~* /wp-content/plugins/edoc-easy-tables/ {
    deny all;
    return 403;
}