CVE-2024-54399: CRUDLab Google Plus Button CSRF Vulnerability

CVE-2024-54399 Overview

CVE-2024-54399 is a Cross-Site Request Forgery (CSRF) vulnerability in the CRUDLab Google Plus Button plugin for WordPress. The flaw allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling persistent script injection through forged administrator requests. The vulnerability affects all versions of the crudlab-google-plus plugin from n/a through 1.0.2. The underlying weakness is classified as [CWE-352] Cross-Site Request Forgery.

Critical Impact
An unauthenticated attacker can trick an authenticated administrator into submitting a crafted request that stores malicious JavaScript in the plugin's settings, executing in the browser of any user who visits the affected page.

Affected Products

CRUDLab Google Plus Button WordPress plugin (crudlab-google-plus)
All versions up to and including 1.0.2
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-12-16 - CVE-2024-54399 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54399

Vulnerability Analysis

The CRUDLab Google Plus Button plugin fails to validate the origin of state-changing requests submitted to its administrative endpoints. Without a valid nonce or referer check, an attacker can craft an HTML page or link that triggers a settings update when visited by an authenticated administrator. Because the affected settings field is rendered without proper output encoding, attacker-controlled input persists as Stored XSS. The script then executes in the context of any user viewing the rendered output.

This chain converts a CSRF weakness into persistent script execution, broadening impact from a single forged request into ongoing compromise of site visitors and administrators.

Root Cause

The root cause is the absence of CSRF protection on the plugin's settings handler combined with missing sanitization of stored values. WordPress plugins are expected to use wp_nonce_field() and check_admin_referer() to validate request origin. The vulnerable handler omits these checks. Stored input is later echoed to the page without escaping through functions such as esc_attr() or esc_html(), allowing injected <script> payloads to execute.

Attack Vector

Exploitation requires user interaction. An attacker hosts a malicious page containing a hidden form or JavaScript that auto-submits a request to the target WordPress site. When an authenticated administrator visits the page, the browser submits the forged request using the administrator's session cookies. The plugin accepts the request, stores the attacker's payload, and serves it back as part of the plugin's output. Subsequent visitors execute the injected script under the site's origin.

Technical details are available in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2024-54399

Indicators of Compromise

Unexpected <script> tags or event handlers stored in the CRUDLab Google Plus Button plugin settings
Outbound requests from site visitors to unfamiliar domains originating from plugin-rendered pages
WordPress audit log entries showing settings modifications without corresponding administrator activity
New or modified administrator accounts created shortly after suspicious settings changes

Detection Strategies

Inspect plugin options stored in the wp_options table for HTML or JavaScript content in CRUDLab-related keys
Review HTTP access logs for POST requests to plugin admin endpoints lacking a same-origin Referer header
Scan rendered pages for inline script content that does not match expected plugin output

Monitoring Recommendations

Monitor file integrity and database changes for the CRUDLab Google Plus Button plugin configuration
Alert on administrator session activity that originates from external referers immediately before settings changes
Track plugin version inventory across WordPress installations to identify hosts still running 1.0.2 or earlier

How to Mitigate CVE-2024-54399

Immediate Actions Required

Deactivate and remove the CRUDLab Google Plus Button plugin until a patched version is confirmed available
Audit the plugin's stored settings for injected scripts and remove any unauthorized payloads
Review WordPress administrator accounts and rotate credentials if compromise is suspected
Apply a web application firewall (WAF) rule to block requests to the plugin's admin endpoints lacking valid nonces

Patch Information

At the time of publication, no patched version beyond 1.0.2 is referenced in the available advisory. Site operators should consult the Patchstack advisory for the latest remediation status and consider permanent removal of the plugin if no fix is forthcoming.

Workarounds

Restrict access to the WordPress administration interface using IP allowlisting or HTTP authentication
Enforce a strict Content Security Policy (CSP) to limit execution of inline scripts on the site
Educate administrators to log out of WordPress sessions before browsing untrusted sites
Replace the plugin with an actively maintained alternative that provides equivalent functionality

bash

# Example: identify and disable the vulnerable plugin via WP-CLI
wp plugin list --name=crudlab-google-plus --fields=name,status,version
wp plugin deactivate crudlab-google-plus
wp plugin delete crudlab-google-plus