CVE-2024-54434: BenJemin phZoom CSRF Vulnerability

CVE-2024-54434 Overview

CVE-2024-54434 is a Cross-Site Request Forgery (CSRF) vulnerability in the BenJemin phZoom WordPress plugin. The flaw affects all versions of phZoom up to and including 1.2.92. The issue is tracked under [CWE-352] and chains CSRF with Stored Cross-Site Scripting (XSS) to allow attackers to inject persistent JavaScript payloads into the affected site. An attacker who tricks an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that stores attacker-controlled script in plugin data.

Critical Impact
Successful exploitation enables persistent JavaScript execution in administrator browser sessions, leading to session hijacking, content tampering, and lateral compromise of WordPress sites.

Affected Products

BenJemin phZoom WordPress plugin versions up to and including 1.2.92
WordPress sites with the phZoom plugin installed and activated
Any WordPress administrator session interacting with the vulnerable plugin endpoints

Discovery Timeline

2024-12-16 - CVE-2024-54434 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54434

Vulnerability Analysis

The vulnerability combines two weaknesses into a single attack chain. The phZoom plugin exposes state-changing endpoints that do not validate the origin of incoming requests using anti-CSRF tokens. The same endpoints accept user-supplied input that is later rendered without proper output encoding, producing a Stored XSS sink. An attacker hosts a malicious page that auto-submits a forged request to the target WordPress site. If an authenticated administrator visits that page, the browser sends the request with valid session cookies, and the payload is stored in the plugin configuration or content.

Root Cause

The root cause is missing CSRF protection on plugin request handlers, classified as [CWE-352]. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose, but the affected handlers in phZoom through 1.2.92 do not enforce nonce validation. Compounding the issue, user-supplied values written by these handlers are stored and later echoed into administrative pages without HTML entity encoding, producing the Stored XSS condition.

Attack Vector

The attack requires network access and user interaction from an authenticated administrator. The attacker prepares a page containing a hidden HTML form or JavaScript fetch call that targets the vulnerable phZoom endpoint with an XSS payload as a parameter value. When the administrator visits the page while logged in, the browser submits the forged request. The plugin stores the payload, which then executes whenever any administrator views the affected page.

No verified public exploit code is available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-54434

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: URIs stored in phZoom configuration rows within the WordPress wp_options table
WordPress admin page responses containing inline JavaScript that was not authored by site administrators
HTTP referer headers on phZoom administrative POST requests pointing to external, untrusted domains

Detection Strategies

Review WordPress access logs for POST requests to phZoom admin endpoints originating from third-party referers or lacking a valid nonce parameter
Scan database tables for stored values containing HTML or JavaScript syntax in plugin-managed fields
Deploy a web application firewall rule that inspects outbound responses for reflected or stored script content on /wp-admin/ pages

Monitoring Recommendations

Alert on administrator account activity that immediately follows visits to external links sent through email or messaging platforms
Monitor changes to plugin option values using WordPress audit logging plugins
Track browser console errors and Content Security Policy violations reported by administrator sessions

How to Mitigate CVE-2024-54434

Immediate Actions Required

Update the phZoom plugin to a version later than 1.2.92 once the vendor releases a patched build
Deactivate and remove the phZoom plugin if a fixed version is not available for your deployment
Audit wp_options and any plugin-specific tables for stored payloads containing script syntax and remove them
Force administrator session logout and rotate WordPress administrator credentials after remediation

Patch Information

At the time of publication, no fixed version is referenced in the available advisory data. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for updates beyond version 1.2.92.

Workarounds

Restrict access to /wp-admin/ endpoints by IP allowlist at the web server or reverse proxy layer
Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrative pages
Require administrators to use separate browser profiles for WordPress management to limit cross-site request exposure
Deploy a virtual patching rule in a WAF to block requests to phZoom endpoints that lack a valid _wpnonce parameter

bash

# Example WAF rule (ModSecurity) to block phZoom POSTs without a nonce
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1005434,msg:'CVE-2024-54434 phZoom CSRF block'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain"
    SecRule ARGS:page "@rx phzoom" \
      "chain"
      SecRule &ARGS:_wpnonce "@eq 0"