CVE-2024-54331 Overview
CVE-2024-54331 is a Cross-Site Request Forgery (CSRF) vulnerability in the Micha I Plant A Tree WordPress plugin (i-plant-a-tree). The flaw allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling persistent script injection through forged authenticated requests. The vulnerability affects all plugin versions up to and including 1.7.3. The weakness is categorized under CWE-352 and requires user interaction from an authenticated administrator to trigger exploitation.
Critical Impact
An attacker who tricks an authenticated administrator into visiting a crafted page can inject persistent JavaScript into the WordPress site, leading to session hijacking, account takeover, or further compromise of site visitors.
Affected Products
- WordPress plugin: i-plant-a-tree (I Plant A Tree by Micha)
- Affected versions: all releases through 1.7.3
- WordPress sites running the vulnerable plugin with authenticated administrators
Discovery Timeline
- 2024-12-16 - CVE-2024-54331 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54331
Vulnerability Analysis
The i-plant-a-tree plugin processes administrative state-changing requests without verifying a valid anti-CSRF token. An attacker can craft a malicious web page that submits a forged request to a vulnerable WordPress site. When an authenticated administrator visits the attacker-controlled page, the browser automatically submits the request using the administrator's session cookies.
Because the plugin also fails to properly sanitize or encode the submitted input before storing it, the forged request can persist attacker-controlled JavaScript into the database. The injected payload then executes in the browser context of any user who loads the affected page, producing Stored XSS.
The Exploit Prediction Scoring System (EPSS) places this issue at 0.202%, indicating low predicted exploitation likelihood at present, but the persistent nature of the injection raises the long-term impact.
Root Cause
The root cause is the absence of CSRF protection on a privileged action that also lacks output encoding and input sanitization. WordPress provides wp_nonce_field() and check_admin_referer() to defend against CSRF, and wp_kses() or esc_html() to neutralize HTML. The plugin omits these safeguards, allowing both the unauthorized request and the script injection to succeed.
Attack Vector
Exploitation occurs over the network and requires user interaction. The attacker hosts a page containing an auto-submitting HTML form or fetch request that targets the vulnerable plugin endpoint. Social engineering, such as a phishing email or a malicious comment link, lures an authenticated administrator to the page. Successful exploitation stores the payload in the WordPress database, and the script then runs whenever the affected page renders.
No authenticated code execution is needed by the attacker. See the Patchstack Vulnerability Analysis for additional technical details.
Detection Methods for CVE-2024-54331
Indicators of Compromise
- Unexpected <script>, onerror, or onload content stored in plugin-managed post meta, options, or custom tables
- WordPress access logs showing POST requests to i-plant-a-tree admin endpoints originating with off-site Referer headers
- Administrator sessions generating requests immediately after visiting external URLs
- New or modified plugin configuration entries containing encoded JavaScript such as <script> or javascript: URIs
Detection Strategies
- Inspect the wp_options table and plugin-specific tables for HTML or JavaScript artifacts that should not appear in configuration fields
- Review web server access logs for cross-origin Referer values on plugin administrative endpoints
- Compare deployed plugin file hashes against the official 1.7.3 distribution to identify tampering
- Enable WordPress audit logging to capture configuration changes made through plugin settings
Monitoring Recommendations
- Alert on outbound DNS or HTTP traffic from administrator browsers to unknown domains immediately after visiting WordPress admin pages
- Monitor for stored content rendering <script> tags within pages served by the plugin to public visitors
- Track administrator authentication events correlated with anomalous POST requests lacking a valid nonce parameter
How to Mitigate CVE-2024-54331
Immediate Actions Required
- Update the i-plant-a-tree plugin to a version later than 1.7.3 once the vendor publishes a fix
- Audit the WordPress database for previously injected payloads stored by the plugin and remove malicious entries
- Force a password reset and session invalidation for all administrator accounts that may have visited untrusted pages
- Restrict administrator access to the WordPress dashboard from trusted networks only
Patch Information
At the time of publication, no fixed version was identified beyond 1.7.3. Site operators should consult the Patchstack advisory and the WordPress plugin repository for an updated release. If no patch is available, consider deactivating and removing the plugin until a fix is released.
Workarounds
- Deactivate and uninstall the i-plant-a-tree plugin until a patched version is released
- Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the plugin endpoints lacking a valid WordPress nonce
- Enforce a strict Content-Security-Policy response header to restrict inline script execution on WordPress pages
- Require administrators to use dedicated browser profiles or sessions when accessing the WordPress dashboard to limit CSRF exposure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
