CVE-2024-12545 – This CSRF vulnerability in the Scratch & Win Wo... (How to Fix)

Q: What is the severity of CVE-2024-12545?

CVE-2024-12545 has a CVSS score of 5.4 (MEDIUM). This CSRF vulnerability in the Scratch & Win WordPress plugin allows unauthenticated attackers to reset the plugin's installation by tricking administrators into clicking malicious links. All WordPress sites using this plugin up to version 2.7.1 are affected. Attackers can disrupt giveaway functionality and potentially cause service interruptions.

📋 TL;DR

This CSRF vulnerability in the Scratch & Win WordPress plugin allows unauthenticated attackers to reset the plugin's installation by tricking administrators into clicking malicious links. All WordPress sites using this plugin up to version 2.7.1 are affected. Attackers can disrupt giveaway functionality and potentially cause service interruptions.

💻 Affected Systems

Products:

Scratch & Win – Giveaways and Contests WordPress Plugin

Versions: All versions up to and including 2.7.1

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin activated. Attack requires administrator interaction with malicious content.

📦 What is this software?

Scratch \& Win by Appsmav

View all CVEs affecting Scratch \& Win →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete disruption of giveaway functionality requiring plugin reconfiguration, potential loss of contest data, and temporary unavailability of promotional features.

🟠

Likely Case

Administrators tricked into clicking malicious links cause plugin reset, requiring manual reconfiguration and temporary service disruption.

🟢

If Mitigated

With proper CSRF protections and user awareness, exploitation attempts fail with no impact on plugin functionality.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires social engineering to trick administrators but uses simple HTTP requests. No authentication required for the reset action itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.7.2 or later

Vendor Advisory: https://wordpress.org/plugins/scratch-win-giveaways-for-website-facebook/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Scratch & Win – Giveaways and Contests'. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 2.7.2+ from WordPress.org and replace plugin files.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Deactivate the plugin until patched to prevent exploitation

wp plugin deactivate scratch-win-giveaways-for-website-facebook

CSRF Protection Middleware

all

Implement web application firewall rules to block unauthorized reset requests

🧯 If You Can't Patch

Implement strict Content Security Policy (CSP) headers to reduce clickjacking risks
Educate administrators about phishing risks and implement multi-factor authentication

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin → Plugins → Installed Plugins. If version is 2.7.1 or lower, you are vulnerable.

Check Version:

wp plugin get scratch-win-giveaways-for-website-facebook --field=version

Verify Fix Applied:

After updating, verify plugin version shows 2.7.2 or higher. Test reset functionality requires proper nonce validation.

📡 Detection & Monitoring

Log Indicators:

POST requests to /wp-admin/admin-ajax.php with action=reset_installation without valid nonce
Plugin reset events in WordPress logs

Network Indicators:

HTTP POST requests to admin-ajax.php with reset_installation parameter from unexpected sources

SIEM Query:

source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters.action="reset_installation")

📊 Metadata

CVE ID: CVE-2024-12545

CVSS v3 Score: 5.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE: CWE-352

EPSS Score: 0.1% exploit probability (26.6th percentile)

Published: January 4, 2025

Last Updated: June 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-12545, you might also want to check these: