CVE-2024-8200 Overview
CVE-2024-8200 affects the Smashballoon Reviews Feed plugin for WordPress, which aggregates testimonials from Google Reviews, Yelp, TripAdvisor, and similar services. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw [CWE-352] present in all versions up to and including 1.1.2. The update_api_key function lacks proper nonce validation, allowing unauthenticated attackers to change the plugin's API key through a forged request. Successful exploitation requires tricking a site administrator into clicking a malicious link or visiting an attacker-controlled page.
Critical Impact
An unauthenticated attacker can silently replace a WordPress site's third-party review service API key, disrupting review integration and enabling redirection of API traffic through attacker-controlled credentials.
Affected Products
- Smashballoon Reviews Feed plugin for WordPress, all versions up to and including 1.1.2
- WordPress sites using the plugin with administrator sessions active
- Sites integrating Google Reviews, Yelp, or TripAdvisor via this plugin
Discovery Timeline
- 2024-08-27 - CVE-2024-8200 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8200
Vulnerability Analysis
The vulnerability resides in the update_api_key handler within the plugin's feed saver manager. WordPress plugins should validate a nonce token before executing state-changing operations to confirm the request originated from a legitimate administrative context. The Smashballoon Reviews Feed plugin omits this validation on the API key update endpoint. As a result, any HTTP request reaching the endpoint while an administrator holds a valid session cookie is processed as authorized. An attacker who convinces an administrator to load a crafted page can trigger the request from the administrator's browser.
While the CSRF flaw does not directly grant code execution, replacing the API key impacts the integrity of review data displayed on the site. Attackers can point the plugin to credentials they control, potentially harvesting API responses or breaking the review integration entirely.
Root Cause
The root cause is missing or incorrect nonce validation in the update_api_key function inside class/Common/Builder/SBR_Feed_Saver_Manager.php. The handler processes API key updates without invoking wp_verify_nonce() or check_admin_referer() against a request-bound token. Refer to the WordPress Plugin Review Code for the vulnerable implementation.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a malicious page containing an auto-submitting HTML form or JavaScript request targeting the vulnerable WordPress endpoint. When an authenticated administrator visits that page, the browser attaches session cookies to the request. The plugin accepts the forged submission and overwrites the stored API key with the attacker-supplied value. No prior credentials or authentication are required from the attacker.
The vulnerability is described in prose only; no verified public proof-of-concept code is available. See the Wordfence Vulnerability Report for additional context.
Detection Methods for CVE-2024-8200
Indicators of Compromise
- Unexpected changes to the third-party review service API key configured in the Smashballoon Reviews Feed plugin
- Review widgets displaying data from unfamiliar accounts, or broken review feeds following an administrator's web browsing session
- HTTP POST requests to the plugin's admin-ajax or REST endpoints originating from external Referer headers
Detection Strategies
- Review WordPress access logs for POST requests targeting the plugin's update_api_key action with off-site or missing Referer headers
- Audit the plugin settings and version through the WordPress admin dashboard; any installation at or below version 1.1.2 is vulnerable
- Correlate administrator browsing activity with unexpected plugin configuration changes recorded in the WordPress options table
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record configuration changes and the user account responsible
- Monitor outbound API calls made by the plugin for unexpected destination endpoints or credential-related errors
- Alert on modifications to wp_options rows associated with the Reviews Feed plugin outside of scheduled maintenance windows
How to Mitigate CVE-2024-8200
Immediate Actions Required
- Update the Smashballoon Reviews Feed plugin to a version above 1.1.2 that includes the nonce validation fix
- Rotate any API keys previously stored by the plugin to invalidate values that may have been replaced
- Instruct administrators to log out of WordPress sessions before browsing untrusted external sites until patched
Patch Information
The vendor addressed the flaw in the plugin repository. See WordPress Changeset #3125315 for the patch that introduces nonce validation on the update_api_key handler. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.
Workarounds
- Temporarily deactivate the Smashballoon Reviews Feed plugin until the patched version is installed
- Restrict administrator access to the WordPress admin panel using IP allowlists or a web application firewall rule blocking cross-origin POSTs to plugin endpoints
- Enforce short administrator session lifetimes to reduce the window in which a CSRF request can succeed
# Update the plugin using WP-CLI to remediate CVE-2024-8200
wp plugin update reviews-feed
wp plugin list --name=reviews-feed --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
