CVE-2024-54337: DX Dark Site CSRF Vulnerability

CVE-2024-54337 Overview

CVE-2024-54337 is a Cross-Site Request Forgery (CSRF) vulnerability in the DevriX DX Dark Site WordPress plugin (devrix-dark-site). The flaw affects all versions up to and including 1.0.1 and enables Stored Cross-Site Scripting (XSS) when an authenticated administrator is tricked into visiting an attacker-controlled page. Successful exploitation allows attackers to persist malicious JavaScript in plugin settings, which executes in the browsers of subsequent site visitors or administrators. The weakness is classified under CWE-352 (Cross-Site Request Forgery).

Critical Impact
An unauthenticated remote attacker can chain CSRF with Stored XSS to compromise WordPress sessions, hijack administrator accounts, and inject persistent malicious scripts.

Affected Products

DevriX DX Dark Site WordPress plugin (devrix-dark-site)
All versions from n/a through 1.0.1
WordPress sites with the plugin installed and activated

Discovery Timeline

2024-12-13 - CVE-2024-54337 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54337

Vulnerability Analysis

The vulnerability combines two web application weaknesses. First, plugin endpoints that modify configuration do not validate anti-CSRF tokens such as WordPress nonces. Second, user-supplied input written through those endpoints is rendered back without proper output encoding, producing Stored XSS.

An attacker hosts a crafted HTML page that submits a forged request to the target WordPress site. If an authenticated administrator visits the page, the browser sends the request with valid session cookies. The plugin processes the request as legitimate and persists attacker-controlled payloads in the database.

When administrators or visitors load pages that render the stored value, the injected JavaScript executes in their session context. Attackers can steal cookies, perform privileged actions, or pivot to full site takeover. The attack requires user interaction but no prior authentication on the attacker side.

Root Cause

The root cause is missing CSRF protection on state-changing requests within devrix-dark-site, compounded by insufficient sanitization and escaping of inputs that are later rendered as HTML. WordPress provides wp_verify_nonce() and escaping helpers such as esc_html() and esc_attr(), but the plugin code paths up to 1.0.1 do not consistently apply them.

Attack Vector

Exploitation occurs over the network with low complexity and requires user interaction. The attacker delivers a malicious link or embedded request through phishing, a compromised site, or a forum post. Once an authenticated administrator interacts with the bait, the forged request silently stores the XSS payload. The scope is changed because the injected script executes in the security context of any user who subsequently loads the affected page.

The vulnerability mechanism is documented in the Patchstack Vulnerability Report. No public proof-of-concept exploit code is referenced in the advisory.

Detection Methods for CVE-2024-54337

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in DX Dark Site plugin options within the wp_options table.
WordPress administrator sessions performing configuration changes immediately after visiting external links.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading WordPress admin pages.
New or modified administrator accounts created without a corresponding audit trail.

Detection Strategies

Inspect plugin settings stored in the database for HTML or JavaScript content where only plain text is expected.
Review web server access logs for POST requests to plugin endpoints lacking a valid Referer header or originating from external domains.
Monitor WordPress audit logs for configuration changes that do not align with administrator activity.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record settings changes, user creation, and plugin modifications.
Deploy a web application firewall with rules that flag cross-origin POST requests to wp-admin endpoints.
Alert on Content Security Policy (CSP) violations indicating inline script execution on administrative pages.

How to Mitigate CVE-2024-54337

Immediate Actions Required

Deactivate and remove the DX Dark Site plugin until a patched version above 1.0.1 is released and verified.
Audit plugin settings and database records for injected payloads and remove any unauthorized script content.
Rotate WordPress administrator passwords and invalidate active sessions to neutralize stolen cookies.
Review user accounts and remove any unauthorized administrators created during the exposure window.

Patch Information

At the time of NVD publication, no fixed version above 1.0.1 is referenced in the advisory. Monitor the Patchstack Vulnerability Report and the official WordPress plugin repository for an updated release that adds nonce verification and input sanitization.

Workarounds

Restrict access to /wp-admin/ by IP allowlist to limit exposure of authenticated administrator sessions.
Enforce a strict Content Security Policy that disallows inline scripts in the WordPress admin interface.
Require administrators to use isolated browser profiles and avoid clicking untrusted links while logged into WordPress.
Deploy a WAF rule that validates the Origin and Referer headers on all state-changing requests to plugin endpoints.

bash

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate devrix-dark-site
wp plugin delete devrix-dark-site

# Verify plugin is no longer present
wp plugin list --status=active | grep -i dark-site