CVE-2024-5943 Overview
CVE-2024-5943 affects the Nested Pages plugin for WordPress in all versions up to and including 3.2.7. The vulnerability stems from missing or incorrect nonce validation on the settingsPage function combined with missing sanitization of the tab parameter. Unauthenticated attackers can exploit this Cross-Site Request Forgery (CSRF) flaw to call local PHP files through forged requests. Exploitation requires tricking a site administrator into clicking a malicious link or visiting an attacker-controlled page. The flaw is tracked under CWE-352 and impacts confidentiality, integrity, and availability of the affected WordPress installation.
Critical Impact
Successful exploitation allows unauthenticated attackers to include arbitrary local PHP files in the context of an administrator session, potentially leading to code execution and full site compromise.
Affected Products
- Kylephillips Nested Pages plugin for WordPress, versions up to and including 3.2.7
- WordPress sites running the vulnerable plugin with administrator users
- Component identifier: kylephillips:nested_pages
Discovery Timeline
- 2024-07-04 - CVE-2024-5943 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5943
Vulnerability Analysis
The Nested Pages plugin exposes a settings page handler that fails to enforce proper anti-CSRF protections. The settingsPage function does not validate a WordPress nonce, so the plugin cannot distinguish legitimate administrator-initiated requests from forged ones. Additionally, the tab request parameter is not sanitized before being used to reference a PHP file. An attacker who can lure an authenticated administrator to a malicious page causes the browser to issue a request to the WordPress admin endpoint with attacker-controlled parameters. The plugin processes that request with administrator privileges and dereferences the unsanitized tab value to load a local PHP file. This combination of missing CSRF protection and unsafe file inclusion turns a social-engineering click into server-side file execution.
Root Cause
The root cause is twofold. First, the plugin omits wp_verify_nonce or equivalent token validation on the settings handler, violating WordPress security guidance for state-changing or sensitive operations. Second, the tab parameter flows into a file-loading routine without an allowlist or path sanitization. Together these defects map to CWE-352: Cross-Site Request Forgery. The relevant source paths are referenced in the Settings configuration and the settings view.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker crafts an HTML page or email containing a link, image, or auto-submitting form that targets the vulnerable Nested Pages settings endpoint. When a logged-in administrator visits the malicious resource, the browser sends authenticated cookies along with the forged request. The plugin then loads the local PHP file referenced by the manipulated tab parameter, executing it in the WordPress administrative context. Refer to the Wordfence vulnerability report for additional technical detail.
Detection Methods for CVE-2024-5943
Indicators of Compromise
- Web server access logs showing GET or POST requests to wp-admin with unexpected values in the tab parameter, particularly path-like values or references to PHP files outside the plugin's settings directory.
- HTTP Referer headers on Nested Pages settings requests that point to external, untrusted domains.
- Unexpected modifications to WordPress options, users, or plugin files following administrator browsing sessions.
Detection Strategies
- Inspect application and reverse-proxy logs for requests to the Nested Pages settings endpoint that lack a valid _wpnonce parameter or that originate from cross-origin referrers.
- Run WordPress vulnerability scanners such as WPScan or Wordfence to flag installations of nested_pages at version 3.2.7 or earlier.
- Correlate administrator browser activity with subsequent privileged plugin requests to identify likely CSRF chains.
Monitoring Recommendations
- Alert on any request to /wp-admin/admin.php?page=nested-pages-settings containing path traversal characters or .php substrings in the tab parameter.
- Monitor file integrity of wp-content/plugins/wp-nested-pages/ and core WordPress directories for unexpected changes.
- Track administrator session activity for anomalous request patterns following clicks on external links.
How to Mitigate CVE-2024-5943
Immediate Actions Required
- Upgrade the Nested Pages plugin to a version newer than 3.2.7 that incorporates the fix delivered in WordPress changeset 3111847.
- Audit administrator accounts and reset credentials if exploitation is suspected, especially after any reported phishing attempts.
- Restrict administrator browsing to trusted destinations and require separate browsers or profiles for WordPress administration.
Patch Information
The maintainer published a fix in WordPress plugin changeset 3111847, which adds nonce validation and parameter handling to the settings page logic. Site operators should update through the WordPress plugin manager or by deploying the patched release from the official plugin repository.
Workarounds
- Temporarily deactivate the Nested Pages plugin until the patched version is installed.
- Deploy a web application firewall rule that blocks requests to the Nested Pages settings endpoint when the tab parameter contains /, \, .., or .php.
- Enforce SameSite=Lax or SameSite=Strict cookies on WordPress sessions to reduce cross-site request feasibility.
- Require administrators to log out of WordPress when browsing untrusted sites and to use dedicated administration workstations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
