CVE-2024-54332: WP Currency Exchange Rates CSRF Vulnerability

CVE-2024-54332 Overview

CVE-2024-54332 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPFactory WP Currency Exchange Rates WordPress plugin. The flaw affects all versions up to and including 1.2.0. Attackers can chain the CSRF weakness to inject Stored Cross-Site Scripting (XSS) payloads into the affected WordPress site. Exploitation requires tricking an authenticated administrator into clicking a crafted link or visiting a malicious page. Once executed, the injected script persists in the database and runs in the browser of any user viewing the affected content. The vulnerability is tracked under CWE-352.

Critical Impact
Successful exploitation chains CSRF with Stored XSS, enabling persistent script execution in the context of WordPress administrators and site visitors, leading to session theft, content manipulation, and account takeover.

Affected Products

WPFactory WP Currency Exchange Rates plugin for WordPress
All versions from initial release through 1.2.0
WordPress sites with the plugin active and accessible administrators

Discovery Timeline

2024-12-16 - CVE-2024-54332 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54332

Vulnerability Analysis

The WP Currency Exchange Rates plugin exposes administrative actions that modify plugin settings without validating an anti-CSRF token. An attacker hosts a malicious page containing a forged request targeting a vulnerable plugin endpoint. When a logged-in administrator visits the page, the browser submits the request using the administrator's session cookies. The plugin processes the request and stores attacker-controlled input in the database without proper sanitization. The stored payload executes as JavaScript whenever the rendered output is viewed.

This chain converts a single-click social engineering attack into a persistent compromise. The XSS payload runs with the privileges of any user who loads the affected page, including site administrators. Attackers can leverage this access to create rogue administrator accounts, exfiltrate session tokens, or pivot to further server-side actions through the WordPress REST API.

Root Cause

The plugin fails to implement WordPress nonce validation on state-changing operations [CWE-352]. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF protection, but the vulnerable handlers do not enforce these checks. Compounding the issue, user-supplied input is rendered into HTML responses without output encoding, producing the Stored XSS sink.

Attack Vector

Exploitation occurs over the network and requires user interaction from a privileged WordPress user. The attacker delivers a crafted URL or HTML page through phishing, forum posts, or compromised third-party sites. No prior authentication on the target site is required by the attacker. The scope changes because the injected script executes in the browsers of other users, including unauthenticated visitors viewing affected pages.

No public proof-of-concept exploit code is available. For additional technical context, see the Patchstack WordPress Plugin Advisory.

Detection Methods for CVE-2024-54332

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers stored in WP Currency Exchange Rates plugin settings or option values
WordPress administrator sessions originating from unusual IP addresses or geographies following a phishing event
New administrator accounts or modified user roles created without authorized change records
Outbound HTTP requests from administrator browsers to unrecognized external domains immediately after loading wp-admin pages

Detection Strategies

Inspect the wp_options table and plugin-specific tables for HTML or JavaScript content in fields that should contain currency codes or numeric values
Audit web server access logs for POST requests to plugin endpoints lacking a valid Referer header pointing to wp-admin
Monitor WordPress audit logs for configuration changes to the plugin that do not correlate with administrator activity

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that blocks requests missing WordPress nonces on plugin admin endpoints
Deploy Content Security Policy (CSP) reporting to capture script execution from unauthorized sources
Forward WordPress and web server logs to a centralized analytics platform to correlate phishing indicators with admin session activity

How to Mitigate CVE-2024-54332

Immediate Actions Required

Update WP Currency Exchange Rates to a version newer than 1.2.0 once the vendor releases a fix; verify the changelog confirms CSRF and XSS remediation
Deactivate and remove the plugin if a patched version is not yet available and the functionality is non-essential
Force a password reset and session invalidation for all WordPress administrator accounts
Audit wp_options and plugin database tables for injected script content and remove malicious entries

Patch Information

As of the last NVD modification on 2026-04-23, the advisory lists affected versions through 1.2.0 with no fixed version identified in the CVE record. Monitor the Patchstack advisory and the official plugin page for an updated release.

Workarounds

Restrict access to /wp-admin/ paths by IP allowlist using web server or reverse proxy rules
Require administrators to authenticate through a separate identity provider with phishing-resistant multi-factor authentication
Apply a virtual patch via WAF rules that enforce the presence of a valid _wpnonce parameter on plugin POST requests
Educate administrators to avoid clicking external links while logged into the WordPress admin console

bash

# Example WAF rule (ModSecurity) requiring nonce on plugin admin requests
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain,deny,status:403,id:1054332,msg:'CVE-2024-54332 CSRF mitigation'"
    SecRule ARGS:page "@rx wp-currency-exchange-rates" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"