CVE-2024-8490: PropertyHive WordPress Plugin CSRF Vulnerability

CVE-2024-8490 Overview

CVE-2024-8490 is a Cross-Site Request Forgery (CSRF) vulnerability in the PropertyHive plugin for WordPress. The flaw affects all versions up to and including 2.0.19. The root cause is missing or incorrect nonce validation in the save_account_details function within class-ph-ajax.php.

Unauthenticated attackers can exploit this issue to modify the name, email address, and password of an administrator account. Exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. Successful exploitation leads to full administrative account takeover of the affected WordPress site.

Critical Impact
Successful exploitation allows unauthenticated attackers to hijack administrator accounts by altering credentials, resulting in complete site compromise.

Affected Products

PropertyHive plugin for WordPress, all versions up to and including 2.0.19
WordPress sites running the wp-property-hive:propertyhive component
Any WordPress installation where an administrator can be socially engineered into visiting an attacker-controlled URL

Discovery Timeline

2024-09-17 - CVE-2024-8490 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8490

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery flaw classified under [CWE-352]. It resides in the save_account_details AJAX handler exposed by the PropertyHive plugin. The handler processes account update requests but fails to validate a WordPress nonce token that would confirm the request originated from a legitimate administrative session.

Because nonce validation is missing or incorrectly implemented, the browser of an authenticated administrator will attach valid session cookies to any cross-origin request that reaches the vulnerable endpoint. An attacker can host a page that automatically submits a forged request to the target site. When the administrator loads the attacker's page, their browser executes the state-changing action on the attacker's behalf.

The impact is limited to integrity, as reflected in the CVSS vector, since the attacker overwrites account fields rather than reading data. However, overwriting the administrator email and password is sufficient to achieve full account takeover through the standard WordPress password reset flow.

Root Cause

The root cause is the absence of proper nonce verification in the save_account_details function located in includes/class-ph-ajax.php. WordPress provides wp_verify_nonce() and check_ajax_referer() to defend AJAX endpoints against forged requests. The vulnerable code paths at lines L976 and L1089 of the 2.0.19 release did not enforce this check on state-changing account updates.

Attack Vector

The attack vector is network based and requires user interaction. An attacker crafts an HTML page or link containing an auto-submitting form or fetch request targeting the vulnerable AJAX endpoint of a PropertyHive-enabled WordPress site. The attacker delivers this link through phishing, forum posts, or malicious advertisements. When an authenticated administrator visits the attacker's resource, the browser transmits their session cookies along with the forged request. The vulnerable endpoint accepts the request and overwrites the administrator's name, email, and password. The attacker then initiates a password reset or logs in directly using the newly set credentials.

For implementation details, see the WordPress PropertyHive AJAX source at line 976 and line 1089.

Detection Methods for CVE-2024-8490

Indicators of Compromise

Unexpected changes to the WordPress administrator account email address, display name, or password hash in the wp_users table
WordPress password reset emails sent to unfamiliar recipient addresses
HTTP POST requests to admin-ajax.php with the action=save_account_details parameter originating from external Referer headers
New administrator logins from unfamiliar IP addresses or user agents shortly after a suspicious inbound link click

Detection Strategies

Inspect web server access logs for POST requests to /wp-admin/admin-ajax.php containing the save_account_details action, particularly when the Referer header points to an external domain
Correlate audit events for user_email or user_pass changes with the absence of a corresponding administrator session in the profile page
Deploy a Web Application Firewall (WAF) rule that blocks requests to the vulnerable action when the nonce parameter is missing or invalid

Monitoring Recommendations

Enable WordPress activity logging for user profile modifications and forward the events to a centralized log platform
Alert on any administrator email or password change that occurs outside of a maintenance window
Monitor for spikes in admin-ajax.php traffic that reference PropertyHive actions from unauthenticated sessions
Review outbound password reset emails for unusual destination domains

How to Mitigate CVE-2024-8490

Immediate Actions Required

Update the PropertyHive plugin to the version that includes the fix from WordPress Changeset 3152548
Force a password reset for all administrator accounts and verify the associated email addresses have not been changed
Review recent modifications to wp_users and wp_usermeta for unauthorized updates
Enable multi-factor authentication (MFA) for all WordPress administrator accounts to reduce the impact of credential takeover

Patch Information

The vendor addressed the vulnerability in the PropertyHive plugin update tracked by WordPress Changeset 3152548. The patch introduces proper nonce validation in the save_account_details handler. Site owners running version 2.0.19 or earlier must upgrade to the patched release. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the PropertyHive plugin until the patched version can be installed
Deploy a WAF rule that blocks POST requests to admin-ajax.php where action=save_account_details is present without a valid _wpnonce value
Restrict access to /wp-admin/ by IP allowlist so external CSRF payloads cannot reach the vulnerable endpoint through an administrator's browser
Train administrators to avoid clicking untrusted links while authenticated to the WordPress admin console

bash

# Example WAF rule (ModSecurity) to block requests missing a nonce
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1008490,\
   msg:'CVE-2024-8490 PropertyHive CSRF block'"
SecRule ARGS:action "@streq save_account_details" "chain"
SecRule &ARGS:_wpnonce "@eq 0"