CVE-2024-0203
📋 TL;DR
The Digits WordPress plugin has a CSRF vulnerability that allows attackers to change user roles to administrator by tricking an admin into clicking a malicious link. This affects all WordPress sites using Digits plugin version 8.4.1 or earlier. Attackers can exploit this without authentication if they can manipulate an admin's actions.
💻 Affected Systems
- WordPress Digits plugin
📦 What is this software?
Digits by Unitedover
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to WordPress sites, enabling complete site takeover, data theft, malware injection, and further privilege escalation.
Likely Case
Attackers create backdoor admin accounts, modify site settings, or inject malicious content through compromised administrator sessions.
If Mitigated
With proper CSRF protections and admin awareness, exploitation requires significant social engineering and may be detected by security monitoring.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators into clicking malicious links. No authentication needed for the CSRF attack itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.2 or later
Vendor Advisory: https://digits.unitedover.com/changelog/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Digits plugin and click 'Update Now'. 4. Verify version is 8.4.2 or higher.
🔧 Temporary Workarounds
Temporary plugin deactivation
allDisable the Digits plugin until patched to prevent exploitation
wp plugin deactivate digits
CSRF protection middleware
allImplement additional CSRF protection at web server or application level
🧯 If You Can't Patch
- Implement strict access controls and monitor for unauthorized role changes
- Educate administrators about phishing risks and implement click-through warnings for admin actions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Digits plugin version 8.4.1 or earlierCheck Version:
wp plugin list --name=digits --field=versionVerify Fix Applied:
Verify Digits plugin version is 8.4.2 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unexpected user role changes in WordPress logs
- Multiple failed login attempts followed by successful admin login
- digits_save_settings function calls without referrer validation
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with action=digits_save_settings
- Requests with unexpected user_role parameters
SIEM Query:
source="wordpress" (event="user_role_change" OR action="digits_save_settings")