CVE-2024-9588: WordPress Category Meta Fields CSRF Flaw

CVE-2024-9588 Overview

The Category and Taxonomy Meta Fields plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 1.0.0. The flaw stems from missing or incorrect nonce validation on the wpaft_option_page function. Unauthenticated attackers can add and delete taxonomy meta if they trick a site administrator into clicking a crafted link. The vulnerability is categorized under CWE-352 and requires user interaction to succeed.

Critical Impact
An attacker who successfully lures an authenticated administrator to a malicious page can add or delete taxonomy meta entries on the target WordPress site without authentication.

Affected Products

Aftabhusain Category and Taxonomy Meta Fields plugin for WordPress
All versions up to and including 1.0.0
WordPress installations using the wp-custom-taxonomy-meta plugin

Discovery Timeline

2024-10-22 - CVE-2024-9588 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9588

Vulnerability Analysis

The vulnerability resides in the wpaft_option_page function within the plugin's options handler. The function processes state-changing requests to manage taxonomy meta fields but does not correctly verify a WordPress nonce before performing the operation. Nonces in WordPress serve as anti-CSRF tokens that bind a request to a specific user session and action. Without proper validation, the plugin trusts any authenticated browser request that reaches the endpoint, regardless of origin.

Because taxonomy meta management functions are exposed through the WordPress admin interface, an administrator's browser session is the required precondition for exploitation. The attacker never authenticates directly. Instead, the victim's browser carries the administrator's session cookie to the plugin endpoint when it loads attacker-controlled content.

Root Cause

The plugin fails to invoke or correctly evaluate wp_verify_nonce() or check_admin_referer() before executing add or delete operations on taxonomy meta. This omission violates the WordPress security model, which requires nonce checks on all state-changing admin actions. The relevant handler is referenced in the WordPress Plugin Code Review.

Attack Vector

An attacker crafts an HTML page or email containing a forged form or image tag that targets the vulnerable plugin endpoint on the victim's WordPress site. When a logged-in administrator visits the malicious page, the browser submits the request with valid session cookies. The plugin executes the requested add or delete action on taxonomy meta. Exploitation requires no attacker credentials but does require user interaction from a privileged victim.

Refer to the Wordfence Vulnerability Report for the vendor-neutral technical write-up.

Detection Methods for CVE-2024-9588

Indicators of Compromise

Unexpected additions or deletions of taxonomy meta entries in the WordPress database, especially in wp_termmeta or plugin-specific tables
HTTP POST requests to admin endpoints containing wpaft_option_page parameters with Referer headers pointing to external domains
Administrator activity logs showing state changes without corresponding admin panel navigation events

Detection Strategies

Inspect web server access logs for requests to the plugin's options page that originate from cross-origin referrers
Enable a WordPress audit logging plugin to record taxonomy meta modifications with user, timestamp, and source IP
Correlate administrator browser activity with taxonomy changes to identify actions that lack a matching admin session workflow

Monitoring Recommendations

Alert on HTTP requests to WordPress admin endpoints where the Referer header does not match the site's own domain
Monitor for unauthenticated or low-privilege user agents triggering admin-only plugin routes
Track write operations against taxonomy meta tables and flag bursts of add or delete activity

How to Mitigate CVE-2024-9588

Immediate Actions Required

Deactivate the Category and Taxonomy Meta Fields plugin until a patched version is available
Restrict administrator browsing behavior and require administrators to log out of WordPress sessions when not actively administering the site
Deploy a web application firewall rule that enforces same-origin referrers on WordPress admin POST requests

Patch Information

At the time of publication, no fixed version has been listed by the vendor. Monitor the WordPress plugin repository and the Wordfence advisory for a release beyond version 1.0.0 that adds nonce validation to the wpaft_option_page function.

Workarounds

Remove the plugin from the wp-content/plugins/wp-custom-taxonomy-meta directory if taxonomy meta functionality is not required
Enforce administrator session hygiene by shortening authentication cookie lifetimes and requiring re-authentication for admin actions
Configure a reverse proxy or WAF to block requests to the plugin endpoint that do not carry a valid same-origin Referer and Origin header

bash

# Example nginx rule to block cross-origin POSTs to the vulnerable endpoint
location ~ /wp-admin/admin\.php {
    if ($request_method = POST) {
        set $csrf_block 0;
        if ($http_origin !~* "^https?://your-site\.example$") { set $csrf_block 1; }
        if ($arg_page = "wpaft_option_page") { set $csrf_block "${csrf_block}1"; }
        if ($csrf_block = "11") { return 403; }
    }
}