CVE-2024-13749
📋 TL;DR
The StaffList WordPress plugin up to version 3.2.3 has a CSRF vulnerability that allows unauthenticated attackers to trick administrators into performing actions that update plugin settings or inject malicious scripts. This affects all WordPress sites using vulnerable versions of the StaffList plugin.
💻 Affected Systems
- WordPress StaffList Plugin
📦 What is this software?
Stafflist by Era404
⚠️ Risk & Real-World Impact
Worst Case
Site takeover through admin credential theft, malware distribution to visitors, or complete site defacement via injected scripts.
Likely Case
Malicious script injection leading to credential theft from site visitors or SEO spam injection.
If Mitigated
No impact if administrators don't click malicious links and proper CSRF protections are in place.
🎯 Exploit Status
CSRF attacks are well-understood and easy to weaponize. No authentication required, but requires social engineering to trick administrators.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.4 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3232922%40stafflist&new=3232922%40stafflist&sfp_email=&sfph_mail=
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find StaffList plugin. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 3.2.4+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the StaffList plugin until patched
wp plugin deactivate stafflist
CSRF Protection via .htaccess
linuxAdd basic CSRF protection headers
Header set X-Frame-Options "SAMEORIGIN"
Header set Content-Security-Policy "frame-ancestors 'self'"
🧯 If You Can't Patch
- Remove StaffList plugin entirely if not essential
- Implement strict Content Security Policy headers to limit script injection impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → StaffList version. If version ≤ 3.2.3, vulnerable.Check Version:
wp plugin get stafflist --field=versionVerify Fix Applied:
Verify StaffList plugin version is 3.2.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin.php?page=stafflist from unexpected referrers
- Multiple failed nonce validation attempts
Network Indicators:
- CSRF attack patterns with forged requests to stafflist endpoints
- Malicious iframe or script tags in plugin settings
SIEM Query:
source="wordpress" AND (uri="/wp-admin/admin.php?page=stafflist" AND method="POST") AND referrer NOT CONTAINS own_domain