CVE-2024-13795
📋 TL;DR
This CSRF vulnerability in the Ecwid Ecommerce Shopping Cart WordPress plugin allows unauthenticated attackers to send deactivation feedback messages on behalf of site owners by tricking administrators into clicking malicious links. All WordPress sites using Ecwid plugin versions up to 6.12.27 are affected.
💻 Affected Systems
- Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Site administrators could unknowingly send deactivation feedback containing sensitive information to the plugin developers, potentially revealing internal data or configuration details.
Likely Case
Attackers could send false deactivation reports that might affect plugin support decisions or reputation, but no direct data theft or site compromise occurs.
If Mitigated
With proper CSRF protections and user awareness, the risk is limited to nuisance-level attacks with minimal operational impact.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators into clicking malicious links. No authentication bypass or direct code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.12.28 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Ecwid Ecommerce Shopping Cart. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress plugin repository and upload manually.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the Ecwid plugin until patched to prevent exploitation
wp plugin deactivate ecwid-shopping-cart
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict cross-origin requests
- Educate administrators about phishing risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Ecwid Ecommerce Shopping Cart → Version. If version is 6.12.27 or lower, you are vulnerable.Check Version:
wp plugin get ecwid-shopping-cart --field=versionVerify Fix Applied:
After updating, verify version is 6.12.28 or higher in WordPress admin plugins page.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with action=ecwid_deactivate_feedback
- Multiple deactivation feedback submissions from same IP
Network Indicators:
- Cross-origin requests to WordPress admin endpoints without proper referrer headers
SIEM Query:
source="wordpress.log" AND "ecwid_deactivate_feedback" AND status=200