CVE-2024-54420 Overview
CVE-2024-54420 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Metrika WordPress plugin by Aleksandr Novikov. The flaw exists in all versions up to and including 1.2. According to the Patchstack Vulnerability Report, the issue chains CSRF into stored Cross-Site Scripting (XSS), enabling attackers to persist malicious payloads through forged administrator actions. The vulnerability is tracked under CWE-352.
Critical Impact
An unauthenticated attacker can trick an authenticated administrator into submitting forged requests that inject persistent JavaScript into the WordPress site, leading to session theft, content manipulation, or further site compromise.
Affected Products
- Aleksandr Novikov Metrika plugin for WordPress
- All versions from n/a through 1.2
- WordPress sites with the Metrika plugin active
Discovery Timeline
- 2024-12-16 - CVE-2024-54420 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-54420
Vulnerability Analysis
The vulnerability stems from missing CSRF protection on state-changing requests in the Metrika plugin. The plugin fails to validate WordPress nonces or verify request origin before processing administrative actions. An attacker hosts a malicious page that issues forged HTTP requests against the target site. When an authenticated administrator visits the attacker-controlled page, their browser submits the request using existing session cookies.
Because the forged request reaches a handler that also lacks proper output sanitization, the attacker chains CSRF into stored XSS. The injected script persists in the plugin's stored settings and executes whenever an administrator loads the affected page. The scope-changed impact reflects that script execution occurs in the browser context of the administrator, crossing the trust boundary between the plugin and the WordPress admin session.
Root Cause
The root cause is the absence of anti-CSRF tokens, identified as [CWE-352]. The plugin does not call wp_verify_nonce() or check_admin_referer() on form submissions handling plugin configuration. Combined with insufficient sanitization of stored input, the flaw permits persistent script injection through forged requests.
Attack Vector
Exploitation requires user interaction. An attacker crafts a web page containing an auto-submitting form or XMLHttpRequest targeting the vulnerable plugin endpoint. The attacker then lures an authenticated WordPress administrator to visit the page through phishing or a watering-hole link. The browser includes the administrator's session cookies, the request is processed without origin validation, and the attacker-supplied payload is stored.
The vulnerability mechanism is described in the Patchstack Vulnerability Report. No verified public exploit code is available at the time of writing.
Detection Methods for CVE-2024-54420
Indicators of Compromise
- Unexpected <script> tags or HTML markup persisted in Metrika plugin configuration fields stored in wp_options.
- Administrator browser sessions executing JavaScript loaded from unfamiliar external domains when visiting plugin admin pages.
- WordPress access logs showing POST requests to Metrika plugin endpoints with Referer headers pointing to external untrusted origins.
Detection Strategies
- Audit the wp_options table for Metrika-related rows containing HTML or JavaScript characters such as <, >, onerror=, or javascript:.
- Review WordPress administrator activity logs for plugin configuration changes that lack a corresponding admin-initiated session context.
- Use a web application firewall to flag cross-origin POST requests targeting /wp-admin/ endpoints associated with the Metrika plugin.
Monitoring Recommendations
- Enable WordPress audit logging plugins to track all plugin setting modifications and administrator actions.
- Monitor outbound DNS and HTTP requests from administrator workstations for connections to suspicious script-hosting domains.
- Alert on Content Security Policy (CSP) violations reported by browsers loading WordPress admin pages.
How to Mitigate CVE-2024-54420
Immediate Actions Required
- Deactivate the Metrika plugin until a patched release is available, as all versions through 1.2 are affected.
- Inspect plugin configuration data for injected scripts and remove any persisted XSS payloads before reactivation.
- Force a password reset and session invalidation for all WordPress administrators who may have visited untrusted sites while logged in.
Patch Information
No fixed version has been published in the NVD record at this time. Refer to the Patchstack advisory for the latest vendor remediation status and apply any future plugin update from the official WordPress plugin repository.
Workarounds
- Remove or disable the Metrika plugin from all WordPress installations until a vendor patch is released.
- Deploy a web application firewall rule that requires a valid Referer or Origin header matching the site domain for POST requests to plugin endpoints.
- Apply a strict Content Security Policy that disallows inline scripts in the WordPress admin interface to limit stored XSS execution.
- Require administrators to use a dedicated browser profile for WordPress management to reduce cross-site request exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
