CVE-2024-54394 Overview
CVE-2024-54394 is a Cross-Site Request Forgery (CSRF) vulnerability in the khubbaib Mandrill WP plugin for WordPress, also distributed under the slug email-form-under-post. The flaw allows an attacker to trick an authenticated administrator into submitting forged requests that inject persistent JavaScript into plugin-managed settings, resulting in Stored Cross-Site Scripting (XSS). The vulnerability affects all versions up to and including 1.0.5. The weakness is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation lets attackers persist malicious JavaScript in the WordPress admin context, enabling session theft, administrative action hijacking, and downstream site compromise.
Affected Products
- khubbaib Mandrill WP plugin for WordPress
- Plugin slug: email-form-under-post
- All versions through 1.0.5
Discovery Timeline
- 2024-12-16 - CVE-2024-54394 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54394
Vulnerability Analysis
The Mandrill WP plugin exposes administrative actions that change plugin configuration without verifying request origin. The plugin does not validate a WordPress nonce or other anti-CSRF token on state-changing endpoints. When an authenticated administrator visits an attacker-controlled page, the browser submits a forged request to the vulnerable endpoint using the admin's active session.
The forged request writes attacker-supplied input into a stored configuration field. Because the plugin also fails to sanitize or encode this input on output, the injected payload executes as Stored XSS whenever the affected page is rendered in the admin or front-end context. Chaining CSRF with Stored XSS converts a single victim click into a persistent foothold inside the WordPress administration interface.
Root Cause
The root cause is the absence of CSRF protections, specifically missing wp_verify_nonce() or check_admin_referer() calls on plugin handlers that mutate stored options. The plugin compounds the issue by storing user input verbatim and rendering it without escaping through functions such as esc_html() or esc_attr().
Attack Vector
Exploitation requires network access and user interaction. An attacker hosts a crafted page or sends a link to an authenticated WordPress administrator. The page triggers an automatic form submission or fetch request to the vulnerable plugin endpoint. The administrator's authenticated session authorizes the request, the malicious payload is stored, and any subsequent page view that renders the field executes the attacker's script.
The vulnerability mechanism is described in the Patchstack advisory for Mandrill WP. No verified public proof-of-concept code is available at this time.
Detection Methods for CVE-2024-54394
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded JavaScript stored in Mandrill WP plugin options within the wp_options table.
- WordPress admin sessions making outbound requests to unknown domains shortly after visiting external links.
- New or modified administrator accounts appearing without a corresponding audit trail.
- Web server logs showing POST requests to Mandrill WP admin endpoints with Referer headers pointing to untrusted external origins.
Detection Strategies
- Audit plugin configuration fields for HTML or JavaScript content using database queries against wp_options rows owned by the plugin.
- Enable a Web Application Firewall (WAF) rule set that flags cross-origin POST requests to /wp-admin/ endpoints lacking a valid nonce parameter.
- Review WordPress activity logs for configuration changes to Mandrill WP that do not correlate with legitimate administrator workflows.
Monitoring Recommendations
- Forward WordPress access and audit logs to a centralized analytics platform and alert on admin-context script execution patterns.
- Monitor browser Content Security Policy (CSP) violation reports for inline script blocks originating from WordPress admin pages.
- Track plugin version inventory across all WordPress instances and alert on hosts still running Mandrill WP <= 1.0.5.
How to Mitigate CVE-2024-54394
Immediate Actions Required
- Identify all WordPress sites running the Mandrill WP plugin and confirm installed versions against 1.0.5.
- Deactivate and remove the plugin if a patched release is not available, or replace it with a maintained alternative.
- Force administrator session reauthentication and rotate credentials for accounts that may have visited untrusted pages while logged in.
- Inspect plugin settings and the wp_options table for injected script payloads and remove them.
Patch Information
At the time of NVD publication, the Patchstack advisory does not list a fixed version. Administrators should treat all releases through 1.0.5 as vulnerable and apply vendor updates when published.
Workarounds
- Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit CSRF reach.
- Deploy a strict Content Security Policy that blocks inline scripts in the WordPress admin interface to reduce Stored XSS impact.
- Require administrators to use separate browser profiles or sessions for WordPress management to limit cross-site request exposure.
- Disable the plugin on production sites until a vendor patch is confirmed and validated.
# Locate vulnerable plugin installations via WP-CLI
wp plugin list --name=email-form-under-post --field=version --allow-root
# Deactivate and delete the plugin until a patched release is available
wp plugin deactivate email-form-under-post --allow-root
wp plugin delete email-form-under-post --allow-root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
