CVE-2024-54392 Overview
CVE-2024-54392 is a Cross-Site Request Forgery (CSRF) vulnerability in the wp-weixin-robot WordPress plugin (WP微信机器人) by midoks. The flaw affects all versions up to and including 5.3.5. An attacker can chain the CSRF weakness with stored Cross-Site Scripting (XSS) to inject persistent JavaScript into the WordPress site when an authenticated administrator visits an attacker-controlled page. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation injects persistent JavaScript into the WordPress site, enabling session theft, administrative action hijacking, and supply-chain style attacks against site visitors.
Affected Products
- midoks WP微信机器人 (wp-weixin-robot) WordPress plugin
- All versions from initial release through 5.3.5
- WordPress sites with the plugin installed and an authenticated administrator session
Discovery Timeline
- 2024-12-16 - CVE-2024-54392 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54392
Vulnerability Analysis
The wp-weixin-robot plugin exposes one or more state-changing administrative actions without verifying a valid WordPress nonce or Origin/Referer header. An attacker hosts a malicious page containing a crafted form or fetch request targeting the plugin's settings endpoint. When an authenticated administrator visits the page, the browser submits the request using the administrator's session cookies.
Because the plugin also fails to sanitize or encode the submitted input before storing it and rendering it back in the admin interface, the attacker-controlled payload is stored as Stored XSS. The injected script executes in the context of any administrator who later loads the affected page.
Root Cause
The root cause is the absence of CSRF token validation on plugin write operations, combined with insufficient output encoding of stored configuration values. Either defect alone would be limited; together they allow remote, unauthenticated attackers to plant persistent script payloads through a victim browser.
Attack Vector
Exploitation requires user interaction. The attacker must lure an authenticated administrator to a controlled URL or embed the malicious request in a page the administrator visits. The request changes scope (S:C) because injected JavaScript executes against the WordPress admin origin, allowing the attacker to act on behalf of the administrator through DOM access. Refer to the Patchstack advisory for further technical details.
Detection Methods for CVE-2024-54392
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= content stored in plugin settings rows of the wp_options table tied to wp-weixin-robot.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading WordPress admin pages.
- New or modified administrator accounts created without a corresponding audit log entry.
Detection Strategies
- Inspect plugin configuration values for HTML or JavaScript characters such as <, >, and javascript: that should not appear in legitimate settings.
- Review web server access logs for POST requests to wp-weixin-robot endpoints lacking a same-origin Referer.
- Monitor WordPress admin sessions for unusual DOM-initiated XHR or fetch traffic when settings pages render.
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option changes and administrator activity.
- Alert on any modification to wp_options rows owned by the plugin from non-administrative source IPs.
- Deploy a Content Security Policy (CSP) that blocks inline script execution in /wp-admin/ to surface injection attempts.
How to Mitigate CVE-2024-54392
Immediate Actions Required
- Update wp-weixin-robot to a version newer than 5.3.5 once the vendor publishes a fix; consult the Patchstack advisory for status.
- Deactivate and remove the plugin if no patched release is available and the functionality is not business-critical.
- Audit plugin settings and the wp_options table for injected script content and remove any malicious entries.
- Rotate administrator credentials and invalidate active WordPress sessions after remediation.
Patch Information
At the time of NVD publication, the vulnerability affects all versions through 5.3.5. Administrators should track the plugin's repository and the Patchstack database entry for an official fixed release. Until a patched version is available, removal is the most reliable remediation.
Workarounds
- Restrict access to /wp-admin/ by IP allowlist so administrator sessions cannot be triggered from arbitrary networks.
- Require administrators to use a dedicated browser profile that does not visit untrusted sites while logged in.
- Deploy a Web Application Firewall (WAF) rule that enforces a same-origin Referer header on POST requests to plugin endpoints.
- Apply a strict Content Security Policy on the WordPress admin interface to block inline and remote script execution.
# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-weixin-robot
wp plugin delete wp-weixin-robot
# Inspect stored plugin options for injected script content
wp option list --search='*weixin*' --format=table
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
