CVE-2024-54389: addWeather myweather CSRF Vulnerability

CVE-2024-54389 Overview

CVE-2024-54389 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Eduardo addWeather (myweather) WordPress plugin. The flaw exists in all versions up to and including 2.5.1. According to the Patchstack advisory, the CSRF weakness can be chained to achieve stored Cross-Site Scripting (XSS), enabling attackers to persist malicious JavaScript through forged administrative requests.

Exploitation requires a privileged user to interact with an attacker-controlled link or page while authenticated to the target WordPress site. Successful abuse compromises confidentiality, integrity, and availability of the affected WordPress instance.

Critical Impact
An attacker can trick an authenticated administrator into submitting forged requests that inject persistent JavaScript into the WordPress site, enabling session theft, content manipulation, and follow-on account takeover.

Affected Products

Eduardo addWeather (myweather) WordPress plugin, versions through 2.5.1
WordPress sites running the vulnerable plugin with administrative sessions
Hosting environments serving the affected plugin to end users

Discovery Timeline

2024-12-16 - CVE-2024-54389 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54389

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens on state-changing endpoints in the addWeather plugin. WordPress provides nonce mechanisms (wp_nonce_field, check_admin_referer, wp_verify_nonce) to bind administrative actions to a user session. The affected plugin endpoints do not enforce these checks before persisting input.

Because user-controlled input flows from the forged request into stored output without sanitization, the CSRF condition escalates into stored XSS. An attacker payload submitted on behalf of an administrator is rendered later in browser contexts, executing JavaScript under the site origin. This grants the attacker access to session cookies, the WordPress REST API, and the administrative dashboard.

The attack requires user interaction such as clicking a crafted link or loading an attacker-controlled page while logged in. The scope change reflected in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, including other site visitors.

Root Cause

The root cause is a combination of two defects: absent CSRF token validation on plugin handlers, and missing output encoding or input sanitization on the data later rendered in pages. WordPress documentation requires both current_user_can() capability checks and nonce verification for any administrative write action. The addWeather plugin omits these controls on the affected handler.

Attack Vector

The attack is network-based and requires no prior authentication from the attacker. The attacker hosts a page containing an auto-submitting HTML form or fetch() request targeting the vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator visits this page, the browser attaches session cookies and the request executes with administrative privileges. The injected payload is stored and executed whenever the affected view is rendered.

No verified public exploit code is published for this CVE. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-54389

Indicators of Compromise

Unexpected <script>, onerror=, or onload= substrings stored in addWeather plugin options or post metadata.
Administrative POST requests to plugin endpoints lacking the standard _wpnonce parameter in access logs.
Outbound requests from visitor browsers to unfamiliar domains shortly after rendering pages that use the addWeather widget.
New or modified WordPress administrator accounts created without a corresponding legitimate session.

Detection Strategies

Inspect plugin database tables and the wp_options table for stored values containing HTML or JavaScript tokens.
Review web server access logs for cross-origin Referer headers on wp-admin POST requests targeting the addWeather plugin.
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to plugin endpoints missing valid nonces.
Hunt for anomalous JavaScript execution patterns in browser telemetry collected from administrator workstations.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes and user role modifications.
Alert on creation of administrator accounts or modification of the siteurl and home options.
Monitor Content Security Policy (CSP) violation reports for inline script execution on admin pages.

How to Mitigate CVE-2024-54389

Immediate Actions Required

Update the addWeather plugin to a version newer than 2.5.1 once the vendor publishes a fix, or deactivate and remove the plugin until a patched release is available.
Force a password reset for all WordPress administrator accounts and invalidate active sessions.
Audit the WordPress database for stored XSS payloads injected through the plugin and remove malicious content.

Patch Information

No fixed version is identified in the NVD record at the time of publication. The vendor advisory linked from the Patchstack Vulnerability Report should be consulted for the latest remediation guidance. Apply the vendor patch as soon as it becomes available.

Workarounds

Deactivate the addWeather plugin until a patched version is released.
Restrict access to wp-admin by IP address using web server or WAF rules.
Deploy a strict Content Security Policy that blocks inline scripts and untrusted origins on administrative pages.
Require administrators to use isolated browser profiles for WordPress administration to limit CSRF exposure.

bash

# Example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate myweather
wp plugin delete myweather

# Verify no residual stored payloads remain in plugin options
wp option list --search='addweather*' --format=table