CVE-2024-54435 Overview
CVE-2024-54435 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Thomas Hoefter Onlywire Multi Autosubmitter plugin for WordPress. The flaw affects all versions up to and including 1.2.4. An attacker can chain the CSRF weakness into a Stored Cross-Site Scripting (XSS) attack by tricking an authenticated administrator into submitting a forged request. The injected payload persists in the WordPress backend and executes in the browser of any user who views the affected page.
Critical Impact
A successful attack stores attacker-controlled JavaScript inside the WordPress instance, allowing session theft, administrative action hijacking, and persistent malicious redirects.
Affected Products
- Thomas Hoefter Onlywire Multi Autosubmitter plugin for WordPress
- All versions from n/a through 1.2.4
- WordPress sites with the onlywire-multi-autosubmitter plugin installed and active
Discovery Timeline
- 2024-12-16 - CVE-2024-54435 published to the National Vulnerability Database
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-54435
Vulnerability Analysis
The Onlywire Multi Autosubmitter plugin exposes state-changing administrative actions without sufficient request origin validation. The plugin fails to verify a valid WordPress nonce or equivalent anti-CSRF token before accepting form submissions that update stored plugin data. An attacker hosts a crafted page containing a hidden form or JavaScript that targets the plugin endpoint. When an authenticated administrator visits the attacker's page, the browser automatically submits the forged request using the administrator's existing session cookies.
The second-order issue is that user-controlled input submitted through these requests is stored without proper output encoding. The stored value renders inside the WordPress dashboard as executable script. This converts a single CSRF event into a persistent XSS foothold across the affected site.
The attack requires user interaction, classifying the impact as scoped to the targeted administrator session. The EPSS probability stands at 0.118%.
Root Cause
The root cause is missing CSRF protection [CWE-352] on plugin administrative endpoints. WordPress provides wp_nonce_field() and check_admin_referer() helpers for this purpose, but the vulnerable handlers do not enforce them. Insufficient sanitization of stored input compounds the issue and enables the XSS payload chain.
Attack Vector
The attack vector is network-based and requires social engineering. An attacker delivers a malicious URL through phishing, a comment, or a third-party site. The victim must hold an authenticated session with the WordPress site running the vulnerable plugin. Once the forged request is submitted, the stored payload executes for every subsequent visitor to the affected admin page.
No verified exploit code is publicly available. Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2024-54435
Indicators of Compromise
- Unexpected <script> tags, event handlers, or obfuscated JavaScript stored in Onlywire Multi Autosubmitter plugin settings tables in the WordPress database.
- WordPress access logs showing administrator POST requests to plugin endpoints with HTTP Referer headers pointing to external or untrusted domains.
- Outbound browser connections from administrator workstations to unfamiliar domains immediately after visiting the WordPress admin dashboard.
Detection Strategies
- Audit the wp_options table and any plugin-specific tables for stored values containing HTML or JavaScript syntax such as <script, onerror=, or javascript:.
- Compare installed plugin versions against the vulnerable range and flag any instance of onlywire-multi-autosubmitter at version 1.2.4 or earlier.
- Monitor web server logs for POST requests to plugin admin endpoints lacking valid _wpnonce parameters.
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) ruleset that inspects WordPress admin POST traffic for missing nonces and known XSS payload signatures.
- Forward WordPress audit logs and web server access logs to a centralized analytics platform for correlation with administrator session activity.
- Alert on creation or modification of administrator accounts and changes to plugin or theme files immediately after admin dashboard visits.
How to Mitigate CVE-2024-54435
Immediate Actions Required
- Deactivate the Onlywire Multi Autosubmitter plugin until a patched version is confirmed and applied.
- Inventory all WordPress sites and identify any instance running onlywire-multi-autosubmitter version 1.2.4 or earlier.
- Review stored plugin settings and remove any unexpected HTML or JavaScript content from the database.
- Force password resets and session invalidation for all WordPress administrator accounts on affected sites.
Patch Information
No patched version is identified in the available advisory data. The vulnerability affects all versions through 1.2.4. Consult the Patchstack Vulnerability Report for vendor updates and apply any newer release once published.
Workarounds
- Remove the plugin entirely if business operations do not require its functionality.
- Restrict access to /wp-admin/ using IP allowlists or VPN-only access to reduce CSRF exposure.
- Deploy a WordPress-aware WAF rule that blocks admin POST requests missing the _wpnonce parameter.
- Train administrators to log out of WordPress before browsing untrusted sites and to use isolated browser profiles for admin work.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate onlywire-multi-autosubmitter
wp plugin delete onlywire-multi-autosubmitter
# Audit for stored XSS payloads in plugin options
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
