CVE-2024-9598 Overview
CVE-2024-9598 is a Cross-Site Request Forgery (CSRF) vulnerability in the AMP for WP – Accelerated Mobile Pages plugin for WordPress. The flaw affects all versions up to and including 1.0.99.1 and stems from missing or incorrect nonce validation on the proxy function. Unauthenticated attackers can craft a malicious link that, when clicked by an authenticated site administrator, forwards the victim's session cookies to an attacker-controlled server. The plugin is widely deployed on WordPress sites to deliver mobile-optimized pages, expanding the potential attack surface across affected installations.
Critical Impact
Successful exploitation enables session hijacking of WordPress administrators, leading to full site compromise including content modification, malware injection, and account takeover.
Affected Products
- AMP for WP – Accelerated Mobile Pages plugin for WordPress, all versions through 1.0.99.1
- WordPress sites running the accelerated-mobile-pages plugin from ampforwp
- Vulnerable file: includes/options/redux-core/inc/class.p.php
Discovery Timeline
- 2024-10-25 - CVE-2024-9598 published to the National Vulnerability Database (NVD)
- 2025-02-27 - Last updated in NVD database
Technical Details for CVE-2024-9598
Vulnerability Analysis
The vulnerability is classified under CWE-352 Cross-Site Request Forgery. The proxy function inside class.p.php of the plugin's bundled Redux Core component fails to validate a WordPress nonce before processing requests. Without nonce verification, the function accepts any cross-origin request that rides on an administrator's authenticated session. Because the proxy endpoint relays user-supplied URLs and forwards request data, an attacker can coerce it into sending the administrator's authentication cookies to an external host. The Wordfence research team tracks this issue under vulnerability identifier 6b155ec8-d69d-40cf-8bea-201629bc9ca6.
Root Cause
The root cause is the absence of a check_ajax_referer() or equivalent nonce validation call within the proxy handler. WordPress relies on nonces as anti-CSRF tokens that bind sensitive actions to a specific user session. When the plugin registered the proxy handler without this check, any authenticated browser session became sufficient authorization to execute the action.
Attack Vector
The attack requires user interaction from an authenticated administrator. An attacker hosts a malicious page or sends a phishing link containing a forged request to the vulnerable proxy endpoint. When the administrator visits the page while logged into WordPress, the browser automatically attaches session cookies to the cross-origin request. The proxy function then echoes or forwards the cookie data to the attacker's server, enabling session reuse and full administrative takeover. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for the affected code path.
Detection Methods for CVE-2024-9598
Indicators of Compromise
- Outbound HTTP requests from the WordPress server to unfamiliar domains originating from the plugin's proxy handler in class.p.php.
- Web server access logs showing requests to the AMP for WP proxy endpoint with externally controlled url parameters.
- Unexpected administrator session activity, such as logins from new IP addresses or modifications to plugin or theme files.
- Referrer headers in proxy requests pointing to external domains rather than the WordPress admin dashboard.
Detection Strategies
- Audit installed plugin versions and flag any AMP for WP installation at or below 1.0.99.1.
- Inspect web access logs for POST or GET requests to the proxy action without a valid _wpnonce parameter.
- Correlate administrator browsing history with outbound requests from the WordPress host to detect cookie exfiltration patterns.
Monitoring Recommendations
- Enable WordPress audit logging to capture administrator session creation, plugin changes, and option updates.
- Forward web server and PHP error logs into a centralized analytics platform for cross-correlation with endpoint telemetry.
- Alert on outbound connections from PHP worker processes to domains outside the organization's allowlist.
How to Mitigate CVE-2024-9598
Immediate Actions Required
- Update the AMP for WP – Accelerated Mobile Pages plugin to a version released after WordPress Changeset 3174071, which adds the missing nonce validation.
- Force a logout of all WordPress administrator sessions and rotate user passwords after patching.
- Review recent administrator actions, installed plugins, and modified files for evidence of unauthorized changes.
- Restrict administrative access to trusted networks using IP allowlisting at the web server or WAF layer.
Patch Information
The vendor addressed the issue in the changeset published at WordPress Changeset 3174071. The fix introduces nonce validation in the proxy handler so that cross-origin requests without a valid _wpnonce token are rejected. Administrators should upgrade to the patched release available through the WordPress plugin repository.
Workarounds
- Deactivate and remove the AMP for WP plugin until the patched version is installed.
- Deploy a web application firewall rule that blocks requests to the plugin's proxy endpoint lacking a valid WordPress nonce.
- Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies to limit cross-site cookie transmission.
- Require administrators to use a dedicated browser profile for WordPress management, reducing exposure to phishing links in normal browsing sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
