CVE-2024-3405
📋 TL;DR
The WP Prayer WordPress plugin through version 2.0.9 lacks CSRF protection when updating settings, allowing attackers to trick logged-in administrators into changing plugin configurations without their consent. This affects all WordPress sites using vulnerable versions of the WP Prayer plugin.
💻 Affected Systems
- WP Prayer WordPress Plugin
📦 What is this software?
Wp Prayer by Goprayer
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify plugin settings to disable security features, inject malicious content, or redirect users to phishing sites, potentially compromising the entire WordPress site.
Likely Case
Attackers could change prayer request settings, modify display configurations, or alter plugin behavior to serve malicious content to site visitors.
If Mitigated
With proper CSRF protection, only authenticated administrators with explicit intent can modify plugin settings, preventing unauthorized configuration changes.
🎯 Exploit Status
Exploitation requires social engineering to trick an administrator into clicking a malicious link while logged into WordPress.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.0 or later
Vendor Advisory: https://wpscan.com/vulnerability/6968d43c-16ff-43a9-8451-71aabbe69014/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Prayer plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable WP Prayer Plugin
allTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate wp-prayer
Implement CSRF Protection Manually
allAdd nonce verification to plugin settings update functions
Requires PHP code modification - consult developer documentation
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement web application firewall with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for WP Prayer version 2.0.9 or earlierCheck Version:
wp plugin get wp-prayer --field=versionVerify Fix Applied:
Verify WP Prayer plugin version is 2.1.0 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unauthorized settings changes in WP Prayer plugin logs
- Multiple failed CSRF token validations
Network Indicators:
- POST requests to wp-admin/admin-post.php without proper referrer headers
- Suspicious redirects from prayer-related pages
SIEM Query:
source="wordpress.log" AND "wp-prayer" AND "settings" AND "updated"