CVE-2024-54414: Geoportail Shortcode CSRF Vulnerability

CVE-2024-54414 Overview

CVE-2024-54414 is a Cross-Site Request Forgery (CSRF) vulnerability in the geoWP Geoportail Shortcode WordPress plugin. The flaw affects all versions up to and including 2.4.4. An attacker can chain the CSRF weakness with stored Cross-Site Scripting (XSS) to inject persistent JavaScript payloads into the WordPress site. Exploitation requires an authenticated user to visit a malicious page while logged in to the target site. The vulnerability maps to CWE-352: Cross-Site Request Forgery and carries a network attack vector with user interaction required.

Critical Impact
An attacker can forge requests on behalf of authenticated administrators to inject stored JavaScript, enabling session theft, content manipulation, and persistent backdoor placement in WordPress sites running Geoportail Shortcode <= 2.4.4.

Affected Products

geoWP Geoportail Shortcode WordPress plugin (geoportail-shortcode)
All versions from initial release through 2.4.4
WordPress installations with the vulnerable plugin enabled

Discovery Timeline

2024-12-16 - CVE-2024-54414 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54414

Vulnerability Analysis

The Geoportail Shortcode plugin exposes state-changing endpoints that accept POST requests without verifying a WordPress nonce or other anti-CSRF token. Because the endpoints also fail to properly sanitize input before storing it in the database, an attacker can persist arbitrary HTML and JavaScript through forged requests. The result is a CSRF-to-Stored-XSS chain that survives across page loads and affects every visitor who renders the compromised content.

The vulnerability requires user interaction, typically clicking a link or loading an attacker-controlled page while authenticated to the WordPress admin interface. Once triggered, the forged request executes with the victim's privileges, including administrators capable of modifying plugin settings. The stored payload then executes in the browser of any user viewing the affected page or admin screen.

With an EPSS score of 0.202%, automated mass exploitation is currently considered unlikely, but targeted attacks against known WordPress administrators remain feasible.

Root Cause

The root cause is the absence of CSRF protection on plugin form submission handlers. The plugin does not validate wp_nonce tokens or check the Referer header before processing administrative actions. Compounding the issue, user-supplied input is stored without proper output encoding or sanitization, allowing script payloads to persist in the database.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing an auto-submitting HTML form or JavaScript fetch() call targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator visits this page, the browser automatically attaches session cookies, and the forged request executes against the target site. The injected payload, typically a <script> tag pointing to an external JavaScript file, is stored persistently and executed each time the affected shortcode or settings page is rendered.

No verified public exploit code is currently published. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-54414

Indicators of Compromise

Unexpected <script>, <iframe>, or onerror= HTML attributes stored in wp_options or wp_postmeta rows associated with the Geoportail Shortcode plugin
Outbound HTTP requests from site visitors' browsers to unfamiliar third-party domains after rendering pages with the [geoportail] shortcode
Administrator session activity originating from referrer URLs outside the WordPress admin domain

Detection Strategies

Audit the WordPress database for HTML or JavaScript content inside Geoportail Shortcode configuration entries using queries against wp_options where the option name matches geoportail%
Deploy a Web Application Firewall (WAF) rule to flag POST requests to plugin endpoints that lack a valid _wpnonce parameter
Review web server access logs for cross-origin POST requests with Referer headers pointing to non-administrative or external domains

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting changes and correlate them with administrator session activity
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages rendering the vulnerable shortcode
Alert on database writes to plugin configuration tables outside of expected maintenance windows

How to Mitigate CVE-2024-54414

Immediate Actions Required

Update the Geoportail Shortcode plugin to a version later than 2.4.4 once the vendor releases a fix
Disable or remove the plugin if no patched version is currently available
Force a password reset and session invalidation for all WordPress administrator accounts
Inspect existing plugin configuration entries for injected script content and remove malicious payloads

Patch Information

As of the last NVD update on 2026-06-17, no fixed version beyond 2.4.4 is listed in the available references. Monitor the Patchstack advisory for updates on a vendor-supplied patch.

Workarounds

Deactivate the geoportail-shortcode plugin until a verified patch is released
Apply a WAF rule that blocks POST requests to plugin endpoints missing a valid WordPress nonce
Restrict WordPress admin access by IP allowlist to reduce the population of users vulnerable to CSRF lures
Implement a strict Content Security Policy that disallows inline scripts and unknown external script sources

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate geoportail-shortcode
wp plugin delete geoportail-shortcode

# Audit stored plugin options for injected scripts
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_name LIKE 'geoportail%' AND option_value LIKE '%<script%';"