CVE-2024-13774 – This CSRF vulnerability in the Wishlist for Woo... (How to Fix)

📋 TL;DR

This CSRF vulnerability in the Wishlist for WooCommerce plugin allows attackers to trick administrators into performing unintended actions, potentially leading to malicious script injection or settings modification. All WordPress sites using this plugin up to version 3.1.7 are affected. Attackers can exploit this without authentication by crafting malicious requests.

💻 Affected Systems

Products:

Wishlist for WooCommerce: Multi Wishlists Per Customer WordPress plugin

Versions: All versions up to and including 3.1.7

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with WooCommerce installed; vulnerability exists in default plugin configuration

📦 What is this software?

Wishlist For Woocommerce by Wpfactory

View all CVEs affecting Wishlist For Woocommerce →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Site takeover through admin account compromise, data theft, or complete defacement via injected malicious scripts

🟠

Likely Case

Unauthorized settings changes, injection of advertising or phishing scripts, or data manipulation

🟢

If Mitigated

Limited impact with proper CSRF protections and admin awareness training

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

CSRF attacks are well-understood and easy to weaponize; requires social engineering to trick admin

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.1.8 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3158156%40wish-list-for-woocommerce&new=3158156%40wish-list-for-woocommerce

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find 'Wishlist for WooCommerce'
4. Click 'Update Now' if available
5. If no update available, download version 3.1.8+ from WordPress repository
6. Deactivate, delete old version, upload and activate new version

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate wish-list-for-woocommerce

CSRF Protection via .htaccess

linux

Add CSRF protection headers at web server level

Header set X-Frame-Options "SAMEORIGIN"
Header set Content-Security-Policy "frame-ancestors 'self'"

🧯 If You Can't Patch

Implement strict Content Security Policy (CSP) headers to limit script execution
Use web application firewall (WAF) rules to block suspicious POST requests to wishlist endpoints

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins

Check Version:

wp plugin get wish-list-for-woocommerce --field=version

Verify Fix Applied:

Verify plugin version is 3.1.8 or higher and check that nonce validation exists in class-alg-wc-wish-list-ajax.php lines 337 and 789

📡 Detection & Monitoring

Log Indicators:

Multiple POST requests to /wp-admin/admin-ajax.php with action=save_to_multiple_wishlist without proper referrer
Unusual admin activity patterns

Network Indicators:

Cross-origin requests to wishlist endpoints
Suspicious iframe or form submissions

SIEM Query:

source="wordpress.log" AND "admin-ajax.php" AND "save_to_multiple_wishlist" AND NOT referrer="*wp-admin*"

📊 Metadata

CVE ID: CVE-2024-13774

CVSS v3 Score: 6.1 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-352

EPSS Score: 0.05% exploit probability (13.7th percentile)

Published: March 8, 2025

Last Updated: March 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13774, you might also want to check these: