CVE-2024-54396: Bet Sport Free CSRF Vulnerability

CVE-2024-54396 Overview

CVE-2024-54396 is a Cross-Site Request Forgery (CSRF) vulnerability in the Bet sport Free WordPress plugin developed by elmervillanueva. The flaw affects all plugin versions up to and including 1.0.0. An attacker can craft a malicious web page that, when visited by an authenticated user, triggers unauthorized state-changing actions in the plugin without the user's consent. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation requires user interaction but can result in limited availability impact on WordPress sites running the affected plugin.

Affected Products

elmervillanueva Bet sport Free plugin for WordPress
All versions from n/a through 1.0.0
WordPress installations with the bet-sport-free plugin activated

Discovery Timeline

2024-12-16 - CVE-2024-54396 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54396

Vulnerability Analysis

The Bet sport Free plugin fails to implement adequate anti-CSRF protections on one or more state-changing request handlers. The plugin does not validate a nonce or origin token before processing sensitive requests. An attacker can therefore forge HTTP requests that the victim's browser submits automatically using existing WordPress session cookies.

The exploit chain requires the victim to be authenticated to the target WordPress site and to visit an attacker-controlled page. When triggered, the browser issues the forged request under the victim's identity. The attack vector is limited to actions the plugin exposes, and impact is scoped to availability according to the published CVSS metrics.

See the Patchstack CSRF Vulnerability Report for the vendor-tracked disclosure.

Root Cause

The root cause is missing CSRF protection on privileged plugin endpoints. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to defend against forged requests. The affected plugin does not consistently apply these controls, allowing cross-origin request submission to be treated as legitimate.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or image tag targeting a vulnerable plugin endpoint. When an authenticated administrator or user visits the page, the browser transmits the forged request with valid session cookies. No credentials or privileges are required by the attacker.

No public proof-of-concept code is available for CVE-2024-54396. Refer to the Patchstack advisory for the affected endpoints and technical details.

Detection Methods for CVE-2024-54396

Indicators of Compromise

Unexpected plugin configuration changes in the bet-sport-free plugin settings without corresponding admin activity
HTTP POST or GET requests to plugin endpoints with a Referer header pointing to an external, untrusted domain
Anomalous administrative actions correlated with an authenticated user browsing external sites

Detection Strategies

Inspect web server access logs for state-changing requests to plugin URIs missing a valid _wpnonce parameter
Correlate WordPress audit-log plugin entries with browser session activity to identify off-origin request patterns
Alert on requests where the Origin or Referer header does not match the WordPress site domain

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture administrative changes with user attribution
Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention
Monitor for the presence of the bet-sport-free plugin across the WordPress fleet and inventory version numbers

How to Mitigate CVE-2024-54396

Immediate Actions Required

Identify all WordPress instances with the bet-sport-free plugin installed and record the version in use
Deactivate and remove the plugin on affected sites until a patched version becomes available
Restrict administrative access to trusted networks and enforce short session timeouts for wp-admin users

Patch Information

As of the last NVD update, no fixed version has been published for the Bet sport Free plugin. All releases through 1.0.0 remain vulnerable. Monitor the Patchstack advisory for vendor updates and remove the plugin if a fix does not materialize.

Workarounds

Uninstall the bet-sport-free plugin and replace it with an actively maintained alternative
Deploy a Web Application Firewall (WAF) rule to block cross-origin POST requests to /wp-admin/admin.php handlers registered by the plugin
Enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-site request delivery
Train administrators to log out of wp-admin sessions when browsing untrusted content

bash

# Configuration example: Nginx rule to block cross-origin POST to wp-admin
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $csrf_block "";
        if ($http_origin !~* "^https?://(www\.)?example\.com$") {
            set $csrf_block "1";
        }
        if ($csrf_block = "1") {
            return 403;
        }
    }
}