CVE-2024-54433: Simple Booking Widget CSRF Vulnerability

CVE-2024-54433 Overview

CVE-2024-54433 is a Cross-Site Request Forgery (CSRF) vulnerability in the Marcel CL Simple Booking Widget plugin for WordPress. The flaw affects all versions up to and including 1.1. An attacker can chain the CSRF weakness with Stored Cross-Site Scripting (XSS), persisting malicious JavaScript into the plugin configuration. Successful exploitation requires an authenticated administrator to visit an attacker-controlled page. The injected payload then executes in the browser of any user viewing the affected WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can forge requests on behalf of an authenticated administrator to inject persistent JavaScript that runs in visitors' browsers, enabling session theft, account takeover, and site defacement.

Affected Products

Marcel CL Simple Booking Widget (simple-booking-widget) WordPress plugin
All versions from n/a through 1.1
WordPress sites with the plugin installed and active

Discovery Timeline

2024-12-16 - CVE-2024-54433 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54433

Vulnerability Analysis

The Simple Booking Widget plugin exposes administrative settings endpoints that lack anti-CSRF protection. State-changing requests are accepted without verifying a WordPress nonce or comparable token. An attacker hosts a crafted page that submits a forged request to the target site. When an authenticated administrator visits that page, the browser sends the request with valid session cookies. The plugin processes the request as legitimate and stores attacker-supplied input.

Because the stored input is later rendered without proper output encoding, the payload triggers Stored XSS. The script executes in every browser that loads the affected page, including other administrators. This combination escalates a single victim click into persistent client-side code execution across the site.

Root Cause

The root cause is the absence of CSRF tokens on settings update handlers, compounded by missing output escaping when the stored values are rendered. WordPress plugins are expected to call wp_verify_nonce() or check_admin_referer() on privileged actions and to escape output with functions such as esc_html() or esc_attr(). The plugin omits both controls in the vulnerable code path.

Attack Vector

Exploitation occurs over the network and requires user interaction. The attacker crafts an HTML page containing an auto-submitting form or an <img>/<script> request targeting the plugin's settings endpoint. The attacker lures an authenticated administrator to the page through phishing, a comment link, or a malicious advertisement. The forged request writes attacker-controlled JavaScript into the plugin configuration. Subsequent page loads execute the payload in the context of the WordPress site origin. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-54433

Indicators of Compromise

Unexpected <script>, onerror, or onload content stored in Simple Booking Widget plugin options within the wp_options table
Outbound requests from visitor browsers to unknown domains originating from pages hosting the booking widget
Administrator sessions with referrers from untrusted external sites immediately before plugin settings changes
New or modified administrator accounts created shortly after a settings update

Detection Strategies

Audit the WordPress database for plugin option values containing HTML or JavaScript syntax
Review web server access logs for POST requests to plugin admin endpoints lacking a valid _wpnonce parameter
Inspect rendered pages for inline scripts that do not match the site's expected content baseline
Deploy a Web Application Firewall (WAF) rule that flags cross-origin form submissions to /wp-admin/ endpoints

Monitoring Recommendations

Enable WordPress activity logging to capture plugin settings changes with user, IP, and referrer metadata
Alert on creation or modification of administrator accounts following plugin configuration updates
Monitor Content Security Policy (CSP) violation reports for unexpected inline script execution
Track plugin version inventory across managed WordPress sites to identify unpatched instances of simple-booking-widget

How to Mitigate CVE-2024-54433

Immediate Actions Required

Deactivate and remove the Simple Booking Widget plugin until a patched version is confirmed available
Rotate administrator passwords and invalidate active WordPress sessions on affected sites
Inspect plugin settings and the wp_options table for injected JavaScript and remove any malicious entries
Review recent administrator activity and revert unauthorized changes

Patch Information

No vendor patch is referenced in the available advisory data for versions through 1.1. Consult the Patchstack Vulnerability Report for the latest fix status and upgrade guidance.

Workarounds

Uninstall the plugin and replace it with an actively maintained booking widget alternative
Restrict /wp-admin/ access by IP allowlist at the web server or WAF layer
Enforce a strict Content Security Policy that disallows inline scripts on WordPress pages
Require administrators to use isolated browser profiles when managing WordPress to limit CSRF exposure

bash

# Configuration example: restrict wp-admin access via nginx allowlist
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}