CVE-2021-24178
📋 TL;DR
This CSRF vulnerability in the Business Directory Plugin for WordPress allows attackers to trick logged-in administrators into performing unauthorized actions like adding, editing, or deleting form fields. This could lead to stored cross-site scripting attacks. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Business Directory Plugin – Easy Listing Directories for WordPress
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could inject malicious scripts into form fields that execute when viewed by users, potentially stealing credentials, session cookies, or performing actions on behalf of users.
Likely Case
Attackers create malicious forms that steal administrator credentials or user data when submitted, leading to account compromise or data theft.
If Mitigated
With proper CSRF protections and input validation, the attack would fail, preventing unauthorized form modifications.
🎯 Exploit Status
Exploitation requires tricking an administrator into clicking a malicious link while logged in. CSRF attacks are well-understood and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.11.1
Vendor Advisory: https://wpscan.com/vulnerability/700f3b04-8298-447c-8d3c-4581880a63b5
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Business Directory Plugin'. 4. Click 'Update Now' if available, or manually update to version 5.11.1 or later.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate business-directory-plugin
Implement CSRF Tokens
allAdd CSRF protection to form submissions if customizing the plugin.
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement web application firewall (WAF) rules to block suspicious form submissions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel under Plugins > Installed Plugins for Business Directory Plugin version.Check Version:
wp plugin get business-directory-plugin --field=versionVerify Fix Applied:
Confirm plugin version is 5.11.1 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual form field modifications in WordPress logs
- Administrator actions from unexpected IP addresses
Network Indicators:
- POST requests to wp-admin/admin-ajax.php with form field parameters from untrusted sources
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND ("action=add_field" OR "action=edit_field" OR "action=delete_field")