CVE-2024-3474 – The Wow Skype Buttons WordPress plugin before v... (How to Fix)

Q: What is the severity of CVE-2024-3474?

CVE-2024-3474 has a CVSS score of 8.8 (HIGH). The Wow Skype Buttons WordPress plugin before version 4.0.4 lacks CSRF protection on some bulk actions, allowing attackers to trick logged-in administrators into performing unauthorized actions like deleting buttons. This affects WordPress sites using vulnerable versions of the plugin with administrative users.

📋 TL;DR

The Wow Skype Buttons WordPress plugin before version 4.0.4 lacks CSRF protection on some bulk actions, allowing attackers to trick logged-in administrators into performing unauthorized actions like deleting buttons. This affects WordPress sites using vulnerable versions of the plugin with administrative users.

💻 Affected Systems

Products:

Wow Skype Buttons WordPress plugin

Versions: All versions before 4.0.4

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with plugin enabled and administrative user logged in.

📦 What is this software?

Wow Skype Buttons by Wow Company

View all CVEs affecting Wow Skype Buttons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could delete all Skype buttons, disrupt communication features, or potentially chain with other vulnerabilities for further compromise.

🟠

Likely Case

Malicious actors trick administrators into deleting configured Skype buttons, causing service disruption.

🟢

If Mitigated

With proper CSRF protections and user awareness, exploitation risk is minimal.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires tricking authenticated admin users into clicking malicious links.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.0.4

Vendor Advisory: https://wpscan.com/vulnerability/e5c3e145-6738-4d85-8507-43ca1b1d5877/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Wow Skype Buttons' and click 'Update Now'. 4. Verify version shows 4.0.4 or higher.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate wow-skype-buttons

CSRF Protection Middleware

all

Implement web application firewall or middleware with CSRF protection.

🧯 If You Can't Patch

Restrict administrative access to trusted networks only
Implement user awareness training about phishing and suspicious links

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Wow Skype Buttons → Version. If below 4.0.4, vulnerable.

Check Version:

wp plugin get wow-skype-buttons --field=version

Verify Fix Applied:

Confirm plugin version is 4.0.4 or higher in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual bulk delete actions in WordPress logs
CSRF token validation failures

Network Indicators:

HTTP POST requests to /wp-admin/admin-ajax.php with bulk action parameters

SIEM Query:

source="wordpress" action="bulk_delete" plugin="wow-skype-buttons"

📊 Metadata

CVE ID: CVE-2024-3474

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-352

Published: May 2, 2024

Last Updated: March 25, 2025

🔗 References

https://wpscan.com/vulnerability/e5c3e145-6738-4d85-8507-43ca1b1d5877/ Exploit,Third Party Advisory
https://wpscan.com/vulnerability/e5c3e145-6738-4d85-8507-43ca1b1d5877/ Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3474, you might also want to check these: