CVE-2024-54355: WP Mailster CSRF Vulnerability

CVE-2024-54355 Overview

CVE-2024-54355 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Mailster WordPress plugin by brandtoss. The flaw affects all plugin versions up to and including 1.8.17.0. Attackers can craft malicious web pages that trigger unauthorized state-changing actions when an authenticated WordPress administrator visits them. The issue is tracked under CWE-352 and stems from missing CSRF token validation on sensitive plugin endpoints.

Critical Impact

Successful exploitation lets a remote attacker perform privileged WP Mailster actions in the context of an authenticated administrator, leading to full compromise of plugin configuration and potential WordPress integrity loss.

Affected Products

• WP Mailster plugin for WordPress, all versions up to and including 1.8.17.0
• Vendor: brandtoss (wpmailster)
• Deployments running the affected plugin on any WordPress site

Discovery Timeline

• 2024-12-16 - CVE-2024-54355 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54355

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness in the WP Mailster plugin. The plugin exposes administrative actions that do not validate the origin or authenticity of incoming requests. An attacker hosts a crafted page that issues forged HTTP requests to a target WordPress instance. When a logged-in administrator visits the attacker-controlled page, the browser submits the request with valid session cookies. WordPress then executes the action as the administrator. The attack requires user interaction but no attacker-side authentication, and it can be delivered through phishing links, malvertising, or embedded iframes.

Root Cause

The root cause is missing or insufficient CSRF protection on privileged plugin handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives to validate request authenticity. The affected WP Mailster code paths through version 1.8.17.0 fail to enforce nonce validation on sensitive operations, allowing forged requests to be accepted as legitimate.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker prepares an HTML page containing a hidden form or JavaScript that targets a vulnerable WP Mailster endpoint. The attacker lures a WordPress administrator to the page through social engineering. The administrator's browser automatically attaches authentication cookies, and the plugin executes the requested action with full administrative privileges. See the Patchstack WP Mailster CSRF Vulnerability advisory for additional details.

Detection Methods for CVE-2024-54355

Indicators of Compromise

• Unexpected configuration changes within WP Mailster plugin settings without corresponding administrator audit entries
• WordPress access log entries showing POST requests to WP Mailster admin endpoints with Referer headers from external or unrelated domains
• Outbound email campaigns, templates, or subscriber list changes that administrators did not initiate

Detection Strategies

• Inspect WordPress wp-admin access logs for state-changing requests to WP Mailster handlers that lack a valid _wpnonce parameter
• Correlate administrator browsing activity with WP Mailster configuration changes to identify forged requests triggered from third-party sites
• Deploy a web application firewall ruleset that flags cross-origin POST requests to /wp-admin/admin.php?page=wp-mailster* endpoints

Monitoring Recommendations

• Enable WordPress activity logging plugins to record every administrator action with timestamp, IP, and referrer metadata
• Alert on Referer header mismatches between WordPress admin requests and the configured site domain
• Monitor email-sending volume and recipient lists from WP Mailster for anomalous spikes that could indicate abuse

How to Mitigate CVE-2024-54355

Immediate Actions Required

• Upgrade WP Mailster to a version released after 1.8.17.0 that includes the CSRF fix
• Audit recent WP Mailster configuration and campaign activity for unauthorized changes
• Force WordPress administrator session invalidation and rotate credentials if compromise is suspected

Patch Information

Review the Patchstack advisory for the latest fixed version of WP Mailster. Apply the patched release through the WordPress plugin updater and verify the new version under Plugins → Installed Plugins after upgrade.

Workarounds

• Temporarily deactivate the WP Mailster plugin until the patched version is installed
• Restrict /wp-admin/ access to known administrator IP addresses via web server or firewall rules
• Require administrators to use isolated browser profiles or sessions when managing WordPress to reduce CSRF exposure

# Example: restrict wp-admin to a trusted IP using nginx
location ^~ /wp-admin/ {
    allow 203.0.113.10;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}