CVE-2024-9990: Odude Crypto Tool CSRF Vulnerability

CVE-2024-9990 Overview

CVE-2024-9990 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Crypto plugin for WordPress in all versions up to and including 2.15. The flaw resides in the crypto_connect_ajax_process::check function, which lacks proper nonce validation. Unauthenticated attackers can exploit this weakness to authenticate as any existing user, including administrators, by tricking a logged-in administrator into clicking a malicious link. The vulnerability is categorized under CWE-352 and carries a network-based attack vector with high impact across confidentiality, integrity, and availability.

Critical Impact
Successful exploitation allows unauthenticated attackers to gain administrator-level access to vulnerable WordPress sites, leading to complete site compromise.

Affected Products

Odude Crypto Tool (WordPress plugin) versions up to and including 2.15
WordPress installations with the Crypto plugin enabled
Sites using the vulnerable crypto_connect_ajax_register.php component

Discovery Timeline

2024-10-29 - CVE-2024-9990 published to the National Vulnerability Database
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-9990

Vulnerability Analysis

The Crypto plugin exposes an AJAX endpoint handled by the crypto_connect_ajax_process::check function. This function processes authentication-related requests but does not verify a WordPress nonce token before executing privileged actions. Without nonce validation, the server cannot distinguish between a legitimate request initiated by an authenticated user and a forged request triggered through a third-party site.

An attacker hosting a malicious page can craft a request targeting the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser automatically includes the administrator's session cookies in the forged request. The plugin processes the request as if it were legitimate, allowing the attacker to log in as that administrator.

This vulnerability requires user interaction, meaning an administrator must be tricked into visiting a malicious URL or clicking a crafted link. The high impact stems from the post-exploitation result: full authenticated access to the WordPress administrative interface.

Root Cause

The root cause is the absence of a wp_verify_nonce() call or equivalent CSRF token validation within the crypto_connect_ajax_process::check function. WordPress provides nonce mechanisms specifically to defend against CSRF, and the plugin failed to implement this control on a sensitive authentication path. The affected code is referenced in the plugin source at lines 31 and 65 of class-crypto_connect_ajax_register.php.

Attack Vector

Exploitation requires the attacker to host a malicious page or send a phishing email containing a forged request. The attack chain is: (1) the attacker crafts an HTML form or JavaScript payload that submits a request to the vulnerable AJAX endpoint, (2) the attacker lures an authenticated WordPress administrator to the malicious resource, (3) the victim's browser submits the request with valid session cookies, and (4) the plugin processes the request and grants authentication tokens to the attacker. The vulnerability mechanism is described in the Wordfence Vulnerability Report and the WordPress Plugin Code Reference.

Detection Methods for CVE-2024-9990

Indicators of Compromise

Unexpected administrator logins originating from unusual IP addresses or geolocations in WordPress logs
HTTP POST requests to admin-ajax.php referencing the crypto_connect_ajax_process action without a valid nonce parameter
New administrator accounts or modifications to existing administrator credentials following a suspicious referrer
Outbound HTTP referrers in web server logs pointing to unfamiliar external domains preceding authentication events

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the crypto_connect_ajax_process action and cross-reference with referrer headers from untrusted origins
Deploy a web application firewall rule that flags AJAX requests to the Crypto plugin endpoints missing the expected _wpnonce token
Monitor WordPress audit logs for authentication events that occur without a preceding legitimate login form submission

Monitoring Recommendations

Enable WordPress activity logging plugins to capture authentication events, user role changes, and plugin configuration modifications
Alert on creation of new administrative users and any privilege escalation occurring outside of approved change windows
Track HTTP referrer headers on authenticated administrative actions and investigate cross-origin sources

How to Mitigate CVE-2024-9990

Immediate Actions Required

Update the Crypto plugin to a version newer than 2.15 that includes the fix introduced in WordPress Changeset 3180126
If an immediate patch is not feasible, deactivate and remove the Crypto plugin from affected WordPress installations
Review WordPress user accounts and revoke any unrecognized administrator accounts or recently elevated privileges
Rotate administrator passwords and invalidate active sessions across all privileged accounts

Patch Information

The vendor addressed CVE-2024-9990 in a release following version 2.15. The fix adds nonce validation to the crypto_connect_ajax_process::check function. Administrators should upgrade through the WordPress plugin management interface or by downloading the latest version from the official WordPress plugin repository. Patch details are available in the WordPress Changeset Update.

Workarounds

Restrict access to /wp-admin/ and admin-ajax.php using IP allowlisting at the web server or WAF layer
Configure a web application firewall to block requests to the vulnerable AJAX action when the _wpnonce parameter is absent or invalid
Train administrators to avoid clicking unknown links while authenticated to the WordPress dashboard and to use separate browser profiles for administrative work

bash

# Example WAF rule pattern to block CSRF attempts against the vulnerable endpoint
# ModSecurity rule example
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1009990,msg:'CVE-2024-9990 CSRF attempt'"
    SecRule ARGS:action "@streq crypto_connect_ajax_process" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"