CVE-2024-56015: Tidy Up Plugin CSRF Vulnerability

CVE-2024-56015 Overview

CVE-2024-56015 is a Cross-Site Request Forgery (CSRF) vulnerability in the John Godley Tidy Up plugin for WordPress that enables reflected Cross-Site Scripting (XSS). The flaw affects all versions of Tidy Up up to and including 1.3. An attacker can craft a malicious link or web page that, when visited by an authenticated WordPress user, triggers a forged request reflecting attacker-controlled script into the response. The issue is tracked under CWE-352 (Cross-Site Request Forgery). Successful exploitation can compromise the targeted user's browser session within the WordPress administrative context.

Critical Impact

Attackers can execute arbitrary JavaScript in an authenticated administrator's browser, leading to session abuse, content manipulation, or further compromise of the WordPress site.

Affected Products

• John Godley Tidy Up plugin for WordPress
• All versions from initial release through 1.3
• WordPress installations with the Tidy Up plugin enabled

Discovery Timeline

• 2024-12-16 - CVE-2024-56015 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56015

Vulnerability Analysis

The Tidy Up plugin processes administrative requests without verifying an anti-CSRF token (nonce) on a code path that also reflects user-controlled input into the response. An attacker who lures an authenticated WordPress user to a malicious page can submit a forged request on the user's behalf. Because the plugin reflects unsanitized input back into the rendered page, the forged request also injects attacker-supplied JavaScript into the user's browser. The combined CSRF and reflected XSS pattern lets the attacker execute script in the privileged context of the target user without requiring credentials.

Root Cause

The root cause is missing or inadequate request origin validation, classified as [CWE-352]. The plugin does not enforce a valid WordPress nonce on the vulnerable handler. Compounding the issue, request parameters are echoed into HTML output without proper context-aware encoding, producing the reflected XSS sink that the CSRF chain abuses.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a malicious page containing an auto-submitting form or crafted link targeting the vulnerable Tidy Up endpoint. When a logged-in WordPress administrator visits the page, the browser sends the authenticated request, and the server reflects the payload, executing the attacker's JavaScript in the administrator's session. The scope changes from the plugin to the broader WordPress origin, allowing the script to act against the WordPress admin interface.

No verified proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-56015

Indicators of Compromise

• Web server access logs showing requests to Tidy Up plugin endpoints with suspicious query parameters containing <script>, javascript:, onerror=, or URL-encoded equivalents.
• HTTP Referer headers pointing to external, untrusted domains on requests that modify plugin state.
• Unexpected administrative actions tied to the Tidy Up plugin in WordPress audit logs.

Detection Strategies

• Inspect WordPress access logs for parameter values that contain HTML or JavaScript syntax targeting Tidy Up routes.
• Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns in query strings against /wp-admin/ endpoints.
• Correlate authenticated admin sessions with off-site referers to identify CSRF lures.

Monitoring Recommendations

• Enable WordPress audit logging to track plugin configuration changes and admin actions.
• Monitor for outbound connections from admin browsers to unknown domains immediately after WordPress activity.
• Alert on browser console errors or Content Security Policy (CSP) violations originating from /wp-admin/ pages.

How to Mitigate CVE-2024-56015

Immediate Actions Required

• Disable or remove the Tidy Up plugin until a fixed version is installed, since all versions through 1.3 are affected.
• Force re-authentication of WordPress administrators and rotate session cookies.
• Restrict access to /wp-admin/ by IP allowlist where operationally feasible.

Patch Information

No fixed version is identified in the NVD record at publication. Track the Patchstack advisory for vendor updates and apply any release that supersedes version 1.3 as soon as it becomes available.

Workarounds

• Deploy a WAF rule that blocks requests to Tidy Up endpoints lacking a valid same-origin Referer or Origin header.
• Enforce a strict Content Security Policy on /wp-admin/ to limit inline script execution.
• Train administrators to avoid clicking untrusted links while logged into WordPress and to use a dedicated browser profile for admin tasks.

# Example Apache configuration to block cross-origin POSTs to wp-admin
<LocationMatch "^/wp-admin/">
    SetEnvIfNoCase Referer "^https?://your-domain\.com/" local_ref
    <LimitExcept GET HEAD>
        Require env local_ref
    </LimitExcept>
</LocationMatch>