CVE-2024-54353: Hack-Info WordPress Plugin CSRF Vulnerability

CVE-2024-54353 Overview

CVE-2024-54353 is a Cross-Site Request Forgery (CSRF) vulnerability in the wpgear Hack-Info WordPress plugin that enables Stored Cross-Site Scripting (XSS). The flaw affects all versions of Hack-Info up to and including 3.17. An attacker can craft a malicious request that, when triggered by an authenticated administrator, injects persistent JavaScript into the WordPress site. The stored payload then executes in the browser of any user visiting the affected page, enabling session theft, content manipulation, or pivoting to further attacks. The weakness is tracked under CWE-352.

Critical Impact
Successful exploitation chains CSRF with Stored XSS, allowing attackers to persistently execute arbitrary script in administrator and visitor sessions on vulnerable WordPress sites.

Affected Products

wpgear Hack-Info WordPress plugin versions up to and including 3.17
WordPress sites with the Hack-Info plugin installed and active
Administrator accounts of sites running vulnerable Hack-Info versions

Discovery Timeline

2024-12-16 - CVE-2024-54353 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54353

Vulnerability Analysis

The vulnerability exists because the Hack-Info plugin does not validate the origin or intent of state-changing HTTP requests. The plugin's request handlers fail to verify a WordPress nonce or equivalent anti-CSRF token before persisting input to the database. An attacker hosts a crafted page or link that issues a forged request to an authenticated administrator's browser. The administrator's session cookie authorizes the request, and attacker-supplied content is stored without sanitization.

Because the injected content is later rendered without proper output encoding, the result is a Stored XSS condition. Each visitor who loads the affected page executes the attacker's JavaScript in the context of the site origin. This combination escalates a single tricked click into persistent compromise of all subsequent visitors.

Root Cause

The root cause is missing CSRF protection [CWE-352] on plugin endpoints that accept user-controlled input. The plugin neither checks wp_verify_nonce() on submission nor escapes stored values on output. These two failures combine into a chained CSRF-to-Stored-XSS primitive.

Attack Vector

Exploitation requires user interaction from a privileged WordPress user. The attacker delivers a malicious link or embeds an auto-submitting form on a third-party page. When an authenticated administrator visits the attacker-controlled page, the browser automatically issues the forged request to the WordPress site. The injected script then executes whenever any user visits the affected admin or front-end page that renders the stored payload. Refer to the Patchstack advisory for additional technical details.

Detection Methods for CVE-2024-54353

Indicators of Compromise

Unexpected <script> tags, event handlers, or obfuscated JavaScript in plugin settings, post metadata, or option tables
New or modified administrator accounts created shortly after an admin session
Outbound HTTP requests from visitor browsers to unknown external domains following page loads
WordPress POST requests to Hack-Info plugin endpoints originating from external Referer headers

Detection Strategies

Audit the wp_options table and Hack-Info-managed records for HTML or JavaScript content that should not be present
Review web server logs for cross-origin requests targeting wp-admin/admin.php or admin-post.php with Hack-Info action parameters
Scan rendered pages with a headless browser to identify injected script tags or unexpected DOM modifications

Monitoring Recommendations

Alert on administrator-context POST requests with external Referer headers to WordPress admin endpoints
Monitor for changes to plugin configuration tables outside of expected administrative workflows
Enable WordPress activity logging to capture option updates and plugin setting changes with user attribution

How to Mitigate CVE-2024-54353

Immediate Actions Required

Update the Hack-Info plugin to a version later than 3.17 once the vendor publishes a patched release
Deactivate and remove the Hack-Info plugin if no patched version is available
Audit all plugin-managed content and WordPress options for injected scripts and remove malicious entries
Force a password reset and session invalidation for all administrator accounts

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 3.17 as affected. Site operators should monitor the plugin's repository for an official fix and apply it immediately upon release.

Workarounds

Restrict access to wp-admin by IP allowlist using web server or WAF rules
Deploy a Web Application Firewall rule to block cross-origin POST requests to Hack-Info admin endpoints
Apply a strict Content Security Policy that disallows inline scripts to limit XSS payload execution
Require administrators to use isolated browser profiles for WordPress administration to reduce CSRF exposure

bash

# Example WAF rule concept: block cross-origin POSTs to admin endpoints
# (adapt to your WAF syntax)
SecRule REQUEST_METHOD "@streq POST" \
  "id:100054353,phase:1,deny,status:403,\
   chain,msg:'Block cross-origin POST to wp-admin (CVE-2024-54353)'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"