CVE-2024-12385
📋 TL;DR
The WP Abstracts WordPress plugin has a Cross-Site Request Forgery vulnerability that allows attackers to trick administrators into performing unauthorized actions. This could lead to deletion of abstracts or injection of malicious scripts. All WordPress sites using WP Abstracts versions up to 2.7.2 are affected.
💻 Affected Systems
- WP Abstracts Manuscripts Manager WordPress Plugin
📦 What is this software?
Wp Abstracts by Kevonadonis
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete all abstracts or inject persistent malicious scripts that compromise the entire WordPress site and visitors.
Likely Case
Attackers trick administrators into clicking malicious links that delete specific abstracts or inject temporary malicious content.
If Mitigated
With proper CSRF protections and user awareness, the risk is minimal as it requires administrator interaction.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators but technical complexity is low once the malicious link is clicked.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.3 or later
Vendor Advisory: https://wordpress.org/plugins/wp-abstracts-manuscripts-manager/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Abstracts Manuscripts Manager. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.7.3+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable WP Abstracts Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate wp-abstracts-manuscripts-manager
Add CSRF Protection Manually
allAdd nonce validation to the vulnerable functions in plugin code
Edit abstracts.manage.php lines 148 and 205 to add wp_verify_nonce() checks
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to limit script execution
- Use WordPress security plugins that add additional CSRF protection layers
🔍 How to Verify
Check if Vulnerable:
Check WP Abstracts plugin version in WordPress admin under Plugins → Installed PluginsCheck Version:
wp plugin get wp-abstracts-manuscripts-manager --field=versionVerify Fix Applied:
Verify plugin version is 2.7.3 or higher and check that nonce validation exists in abstracts.manage.php📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin/admin-ajax.php with action=wpabstracts_load_status or wpabstracts_delete_abstracts
- Multiple abstract deletions in short time period
Network Indicators:
- HTTP requests with missing or invalid _wpnonce parameter to vulnerable endpoints
SIEM Query:
source="wordpress.log" AND (action="wpabstracts_load_status" OR action="wpabstracts_delete_abstracts") AND NOT _wpnonce=*🔗 References
- https://plugins.trac.wordpress.org/browser/wp-abstracts-manuscripts-manager/trunk/abstracts/abstracts.manage.php#L148
- https://plugins.trac.wordpress.org/browser/wp-abstracts-manuscripts-manager/trunk/abstracts/abstracts.manage.php#L205
- https://plugins.trac.wordpress.org/changeset/3223874/
- https://wordpress.org/plugins/wp-abstracts-manuscripts-manager/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/79af711e-d044-447e-9802-8be648a3843d?source=cve
