CVE-2024-54393: WP Fiddle CSRF Vulnerability

CVE-2024-54393 Overview

CVE-2024-54393 is a Cross-Site Request Forgery (CSRF) vulnerability in the Sheikh Heera WP Fiddle plugin for WordPress. The flaw affects all versions of WP Fiddle up to and including 1.0. An attacker can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) payload, persisting malicious JavaScript into the WordPress site when an authenticated administrator visits an attacker-controlled page. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A successful attack stores attacker-controlled JavaScript that executes in the browser of any user visiting affected WordPress pages, enabling session theft, account takeover, and persistent site compromise.

Affected Products

Sheikh Heera WP Fiddle (wp-fiddle) WordPress plugin
All versions from n/a through 1.0
WordPress sites with the plugin installed and active

Discovery Timeline

2024-12-16 - CVE-2024-54393 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54393

Vulnerability Analysis

The WP Fiddle plugin exposes state-changing administrative actions without verifying CSRF tokens. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer() to bind requests to authenticated user sessions. The plugin omits this validation on input-handling endpoints, allowing forged requests to reach privileged handlers.

The issue compounds because the same endpoints fail to sanitize or escape user-supplied input before storing it. An attacker can therefore submit JavaScript through a forged request, and the payload persists in plugin-controlled data. When a legitimate user later renders the affected admin or front-end view, the stored script executes in their browser context.

The combination produces a CSRF-to-Stored-XSS chain. The attacker does not need credentials but does need an authenticated victim to interact with attacker-controlled content.

Root Cause

The root cause is the absence of CSRF nonce verification on plugin request handlers combined with missing output encoding on stored fields. Either control alone would break the attack chain. See the Patchstack WordPress Vulnerability Report for advisory details.

Attack Vector

Exploitation requires an authenticated WordPress administrator to visit a malicious page or click a crafted link. The attacker's page issues a forged POST request to the vulnerable WP Fiddle endpoint, carrying a script payload in a writable field. The plugin processes the request under the victim's session and persists the payload. Subsequent renderings of the affected view execute the script for any viewer.

Detection Methods for CVE-2024-54393

Indicators of Compromise

Unexpected <script>, onerror, or onload content in WP Fiddle plugin database tables or options.
WordPress admin sessions creating new administrator accounts or modifying plugin options without corresponding admin activity logs.
HTTP referer headers on WP Fiddle POST requests pointing to external, unrelated domains.

Detection Strategies

Audit the wp_options table and any WP Fiddle custom tables for HTML or JavaScript content in fields expected to hold plain text.
Inspect web server access logs for POST requests to WP Fiddle endpoints originating from cross-origin referers.
Deploy a Web Application Firewall (WAF) rule that flags requests to plugin admin endpoints lacking a valid _wpnonce parameter.

Monitoring Recommendations

Enable WordPress activity logging to track plugin setting changes and correlate them with administrator login sources.
Monitor outbound traffic from administrator browsers for callbacks to unfamiliar domains, which can indicate XSS payload execution.
Centralize WordPress and web server logs for retrospective hunting whenever a new plugin CVE is published.

How to Mitigate CVE-2024-54393

Immediate Actions Required

Deactivate and remove the WP Fiddle plugin (wp-fiddle) until a patched version is published by the maintainer.
Force a password reset for all WordPress administrator accounts and invalidate active sessions.
Review installed plugins and user accounts for unauthorized additions made during the exposure window.

Patch Information

No vendor patch is referenced in the advisory at the time of publication. The vulnerability affects all versions through 1.0, and no fixed release is listed in the Patchstack advisory. Operators should monitor the plugin repository for updates and remove the plugin until a fixed version is available.

Workarounds

Uninstall WP Fiddle and replace it with an actively maintained alternative.
Restrict /wp-admin/ access by IP allowlist at the web server or WAF layer to limit exposure to forged requests.
Enforce a strict Content Security Policy (CSP) that blocks inline scripts and unknown script sources to limit XSS payload execution.

bash

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-fiddle
wp plugin delete wp-fiddle

# Optional: block direct access to plugin endpoints at the web server
# Example nginx rule
location ~* /wp-content/plugins/wp-fiddle/ {
    deny all;
    return 403;
}