CVE-2024-12322 – This CSRF vulnerability in ThePerfectWedding.nl... (How to Fix)

Q: What is the severity of CVE-2024-12322?

CVE-2024-12322 has a CVSS score of 8.8 (HIGH). This CSRF vulnerability in ThePerfectWedding.nl Widget plugin for WordPress allows attackers to inject malicious scripts into the plugin's configuration by tricking administrators into clicking malicious links. All WordPress sites using this plugin up to version 2.8 are affected. Successful exploitation leads to stored cross-site scripting attacks.

📋 TL;DR

This CSRF vulnerability in ThePerfectWedding.nl Widget plugin for WordPress allows attackers to inject malicious scripts into the plugin's configuration by tricking administrators into clicking malicious links. All WordPress sites using this plugin up to version 2.8 are affected. Successful exploitation leads to stored cross-site scripting attacks.

💻 Affected Systems

Products:

ThePerfectWedding.nl Widget WordPress Plugin

Versions: All versions up to and including 2.8

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin activated. Attack requires administrator interaction with malicious link.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain persistent XSS on the WordPress admin panel, potentially compromising administrator accounts, stealing session cookies, or redirecting users to malicious sites.

🟠

Likely Case

Attackers inject malicious JavaScript that steals administrator credentials or session cookies when administrators visit the plugin settings page.

🟢

If Mitigated

With proper CSRF protections and content security policies, the attack would fail or have limited impact.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires social engineering to trick administrators into clicking malicious links. No authentication bypass needed for the CSRF attack itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 2.8

Vendor Advisory: https://plugins.trac.wordpress.org/browser/theperfectweddingnl-widget

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'ThePerfectWedding.nl Widget'. 4. Click 'Update Now' if available, or delete and install latest version from WordPress repository.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the plugin until patched version is available

wp plugin deactivate theperfectweddingnl-widget

🧯 If You Can't Patch

Implement Content Security Policy headers to restrict script execution
Use browser extensions that block CSRF attacks or enforce same-origin policies

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → ThePerfectWedding.nl Widget → Version. If version is 2.8 or lower, you are vulnerable.

Check Version:

wp plugin get theperfectweddingnl-widget --field=version

Verify Fix Applied:

After update, verify plugin version is higher than 2.8 in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin/admin.php?page=tpwAdminPanel with tpwKey parameter containing script tags

Network Indicators:

HTTP requests with suspicious tpwKey parameter values containing JavaScript

SIEM Query:

source="wordpress" AND uri="*tpwAdminPanel*" AND (param="tpwKey" AND value="*script*" OR value="*javascript:*")

📊 Metadata

CVE ID: CVE-2024-12322

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-352

EPSS Score: 0.06% exploit probability (19.1th percentile)

Published: January 7, 2025

Last Updated: January 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-12322, you might also want to check these: