CVE-2024-54397: Go Animate CSRF Vulnerability

CVE-2024-54397 Overview

CVE-2024-54397 is a Cross-Site Request Forgery (CSRF) vulnerability in the Go Animate WordPress plugin developed by antonio.gocaj. The flaw affects all versions of Go Animate up to and including 1.0. By chaining the missing CSRF protection with insufficient output sanitization, an attacker can achieve Stored Cross-Site Scripting (XSS) against a privileged WordPress user. Successful exploitation requires the targeted administrator to visit an attacker-controlled page while authenticated to the WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An unauthenticated attacker can coerce an authenticated WordPress administrator into submitting a forged request that injects persistent JavaScript into the site, enabling session theft, account takeover, and further compromise of the WordPress instance.

Affected Products

Go Animate WordPress plugin by antonio.gocaj — all versions through 1.0
WordPress sites with the goanimate plugin installed and activated
Any WordPress administrator session interacting with the vulnerable plugin endpoints

Discovery Timeline

2024-12-16 - CVE-2024-54397 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54397

Vulnerability Analysis

The Go Animate plugin exposes administrative actions that change plugin state without verifying a WordPress nonce or other anti-CSRF token. The same handlers also fail to properly sanitize and escape user-supplied input before storing it and rendering it back in the WordPress dashboard. This combination converts a state-changing CSRF into a Stored XSS primitive. An attacker hosts a crafted page or link that automatically issues a request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser silently submits the request with valid session cookies, persisting malicious JavaScript inside the plugin's stored data.

Root Cause

The root cause is the absence of CSRF protection on plugin actions that accept user input. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to bind a request to an authenticated session, but the affected handlers do not invoke them. Compounding this, stored values are echoed without esc_html() or esc_attr() escaping, producing the Stored XSS sink. See the Patchstack Vulnerability Report for the upstream technical details.

Attack Vector

Exploitation is network-based and requires user interaction from an authenticated administrator. The attacker delivers a malicious link or embedded resource through phishing, a comment, an external site, or a watering-hole page. Once the administrator visits the page, an auto-submitting HTML form or fetch() call posts attacker-controlled JavaScript to the vulnerable Go Animate endpoint. The payload is persisted and executes in the browser of any user who later loads the affected administrative or front-end view, escalating from CSRF to Stored XSS within the WordPress trust boundary.

Detection Methods for CVE-2024-54397

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror=, onload=), or obfuscated JavaScript stored in Go Animate plugin options or post metadata
New or modified WordPress administrator accounts created shortly after an admin browsing session
Outbound HTTP requests from admin browsers to unfamiliar domains immediately after loading WordPress admin pages containing Go Animate content

Detection Strategies

Audit the wp_options table and Go Animate-related custom tables for HTML or JavaScript content where plain text is expected
Inspect web server access logs for POST requests to Go Animate admin endpoints lacking a valid Referer header originating from the WordPress site
Review WordPress audit logs for plugin configuration changes that do not correlate with legitimate administrator activity

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that flags cross-origin POST requests targeting /wp-admin/ endpoints
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on admin pages
Alert on creation, modification, or privilege changes for WordPress user accounts outside of approved change windows

How to Mitigate CVE-2024-54397

Immediate Actions Required

Deactivate and remove the Go Animate plugin from all WordPress installations until a patched version is published by the maintainer
Rotate WordPress administrator passwords and invalidate active sessions via wp_logout_all_users or by rotating AUTH_KEY and SECURED_AUTH_KEY salts
Scan plugin-managed database tables for stored JavaScript and remove any malicious content

Patch Information

No fixed version has been published at the time of NVD entry. The vulnerability affects Go Animate through version 1.0 with no patched release identified in the Patchstack Vulnerability Report. Site operators should treat the plugin as end-of-life pending an upstream fix and replace it with a maintained alternative.

Workarounds

Remove the goanimate plugin directory from wp-content/plugins/ to prevent its endpoints from being reachable
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer so that forged cross-origin requests cannot reach plugin handlers
Deploy a strict Content Security Policy that disallows inline scripts on WordPress admin pages to neutralize the XSS sink if the plugin must remain temporarily installed

bash

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate goanimate
wp plugin delete goanimate

# Rotate authentication salts to invalidate existing admin sessions
wp config shuffle-salts