CVE-2024-3643
📋 TL;DR
This vulnerability in the Newsletter Popup WordPress plugin allows attackers to trick logged-in administrators into deleting newsletter lists via Cross-Site Request Forgery (CSRF) attacks. Attackers can craft malicious requests that appear legitimate, causing administrators to unknowingly perform destructive actions. Only WordPress sites using vulnerable versions of the Newsletter Popup plugin are affected.
💻 Affected Systems
- Newsletter Popup WordPress Plugin
📦 What is this software?
Newsletter Popup by Mndpsingh287
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete all newsletter subscriber lists, causing permanent data loss and disrupting email marketing operations.
Likely Case
Targeted deletion of specific subscriber lists, potentially affecting customer communication and marketing campaigns.
If Mitigated
No impact if proper CSRF protections are implemented or if administrators don't visit malicious sites while logged in.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators into visiting malicious pages while logged into WordPress admin.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.3 or later
Vendor Advisory: https://wpscan.com/vulnerability/698277e6-56f9-4688-9a84-c2fa3ea9f7dc/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Newsletter Popup plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and remove plugin, then install latest version from WordPress repository.
🔧 Temporary Workarounds
Disable Newsletter Popup Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate newsletter-popup
Implement CSRF Protection Manually
allAdd nonce verification to delete list functionality
Edit plugin PHP files to add wp_verify_nonce() checks before delete actions
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement web application firewall rules to block CSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Newsletter Popup version. If version is 1.2 or earlier, you are vulnerable.Check Version:
wp plugin get newsletter-popup --field=versionVerify Fix Applied:
After updating, verify plugin version is 1.3 or later in WordPress admin plugins page.📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to newsletter list endpoints from same IP
- Unusual deletion patterns in newsletter subscriber logs
Network Indicators:
- HTTP POST requests to wp-admin/admin-ajax.php with delete_list action without proper referrer headers
SIEM Query:
source="wordpress.log" action="delete_list" AND NOT referrer CONTAINS "yourdomain.com"