CVE-2024-12414
📋 TL;DR
This CSRF vulnerability in the Themify Store Locator WordPress plugin allows attackers to modify plugin settings without authentication by tricking administrators into clicking malicious links. All WordPress sites using this plugin up to version 1.1.9 are affected. The attack requires social engineering to target administrators.
💻 Affected Systems
- Themify Store Locator WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify store location data, inject malicious content, or disrupt business operations by altering plugin functionality.
Likely Case
Attackers modify store location settings to redirect users to malicious sites or display fraudulent information.
If Mitigated
With proper CSRF protections, administrators would be prompted for confirmation before settings changes.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators. No authentication needed for the CSRF attack itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Themify Store Locator'. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.2.0+ from WordPress.org and replace the plugin files.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate themify-store-locator
Add CSRF Protection Manually
allAdd nonce validation to the setting_page() function
Edit includes/init.php line 142 to add wp_verify_nonce() check
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement web application firewall rules to block CSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Themify Store Locator version. If version is 1.1.9 or lower, you are vulnerable.Check Version:
wp plugin get themify-store-locator --field=versionVerify Fix Applied:
Verify plugin version is 1.2.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /wp-admin/admin.php?page=themify-store-locator
- Multiple failed nonce validation attempts
Network Indicators:
- CSRF attack patterns in web traffic
- Suspicious referrer headers
SIEM Query:
source="wordpress" AND (uri="/wp-admin/admin.php?page=themify-store-locator" AND method="POST")🔗 References
- https://plugins.trac.wordpress.org/browser/themify-store-locator/tags/1.1.9/includes/init.php#L142
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206624%40themify-store-locator&new=3206624%40themify-store-locator&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/287abdef-24de-4e1b-a673-59cd37411bf6?source=cve
