CVE-2024-54431 Overview
CVE-2024-54431 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the phpdevp Admin Customization (wpp-customization) plugin for WordPress. The flaw chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious scripts in administrative contexts. The issue affects all versions of Admin Customization up to and including version 2.2. Successful exploitation requires an authenticated administrator to interact with attacker-controlled content, such as visiting a crafted page while logged into WordPress.
Critical Impact
An unauthenticated attacker can trick an authenticated WordPress administrator into submitting a forged request that injects persistent JavaScript into plugin-managed settings, enabling session hijacking, privilege abuse, and further compromise of the WordPress site.
Affected Products
- phpdevp Admin Customization plugin for WordPress
- Plugin slug: wpp-customization
- Versions from n/a through 2.2 (inclusive)
Discovery Timeline
- 2024-12-16 - CVE CVE-2024-54431 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-54431
Vulnerability Analysis
The vulnerability combines two weaknesses into a single exploit chain. The plugin's administrative endpoints accept state-changing requests without verifying a valid anti-CSRF token, and the same endpoints store user-supplied input without proper output encoding. An attacker hosts a malicious page containing an auto-submitting form or JavaScript that targets the plugin's settings handler. When a logged-in WordPress administrator visits the page, the browser submits the forged request using the administrator's session cookies. The plugin accepts the request and writes attacker-controlled markup into persistent storage. Any subsequent visit to the affected admin or front-end view renders the injected script in the victim's browser. Because the attack vector is network-based and the user interaction requirement is satisfied by a simple page visit, the barrier to exploitation is low.
Root Cause
The root cause is missing CSRF protection on plugin administrative actions, specifically the absence of WordPress nonce verification using wp_verify_nonce() or check_admin_referer(). Compounding this, the plugin fails to sanitize input on save with functions such as wp_kses_post() and does not escape output with esc_html() or esc_attr(), permitting persistent script injection.
Attack Vector
The attacker crafts an HTML page containing a hidden form that POSTs to the plugin's settings endpoint with malicious <script> payloads. The attacker then lures an authenticated administrator to the page through phishing, a comment link, or social engineering. The administrator's browser submits the forged request with valid authentication cookies. The plugin stores the payload, and the injected script executes whenever the affected page is rendered in any user's session, including other administrators.
No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-54431
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes (e.g., onerror=, onclick=) stored in wp_options rows associated with the wpp-customization plugin.
- WordPress access logs showing POST requests to plugin admin endpoints originating from external Referer headers rather than wp-admin pages.
- Administrator browser sessions making outbound requests to unfamiliar domains shortly after visiting external links.
Detection Strategies
- Audit the WordPress database for plugin option values containing HTML or JavaScript content using queries against wp_options filtered by plugin key prefixes.
- Inspect web server access logs for POST requests to plugin settings URLs that lack a same-origin Referer or that occur outside expected administrator workflows.
- Use a WordPress security scanner or file integrity monitor to flag the installed version of wpp-customization at or below 2.2.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script violations in the WordPress admin and public site.
- Forward WordPress audit logs and web server logs to a centralized SIEM and alert on plugin option modifications outside change windows.
- Monitor administrator accounts for anomalous activity such as new user creation, theme edits, or plugin installs that may follow a successful XSS payload.
How to Mitigate CVE-2024-54431
Immediate Actions Required
- Identify all WordPress sites running the Admin Customization (wpp-customization) plugin at version 2.2 or earlier and disable the plugin until a fix is available.
- Review plugin-stored settings and remove any unexpected HTML or JavaScript content from the database.
- Force password resets and session invalidation for WordPress administrators who may have visited untrusted external links.
Patch Information
No fixed version is published in the NVD record at the time of writing. Refer to the Patchstack Vulnerability Report for the latest vendor remediation status. If no patched release is available, removal of the plugin is the recommended path.
Workarounds
- Uninstall the wpp-customization plugin and replace it with a maintained alternative that enforces nonce verification on admin actions.
- Deploy a Web Application Firewall (WAF) rule that blocks POST requests to plugin admin endpoints lacking a valid same-origin Referer and WordPress nonce parameter.
- Apply a strict Content Security Policy that disallows inline scripts in the WordPress admin to limit the impact of stored XSS payloads.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wpp-customization
wp plugin delete wpp-customization
# Verify removal
wp plugin list --status=active | grep -i wpp-customization
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
