CVE-2024-49290
📋 TL;DR
This CSRF vulnerability in the Cooked Pro WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions. It affects WordPress sites using Cooked Pro versions before 1.8.0. Attackers could modify plugin settings or perform other administrative actions without the victim's knowledge.
💻 Affected Systems
- Cooked Pro WordPress Plugin
📦 What is this software?
Cooked by Boxystudio
⚠️ Risk & Real-World Impact
Worst Case
Attackers could reconfigure the plugin to disable security features, modify recipe data, or potentially chain with other vulnerabilities for more severe impact.
Likely Case
Attackers modify plugin settings, change recipe content, or disrupt normal plugin functionality through forged administrative requests.
If Mitigated
With proper CSRF protections and user awareness, impact is limited to unsuccessful attack attempts.
🎯 Exploit Status
CSRF attacks typically require social engineering to trick authenticated users into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.0
Vendor Advisory: https://patchstack.com/database/vulnerability/cooked-pro/wordpress-cooked-pro-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Cooked Pro and click 'Update Now'. 4. Verify version is 1.8.0 or higher.
🔧 Temporary Workarounds
CSRF Token Implementation
allAdd CSRF protection to plugin forms if custom modifications exist
Plugin Deactivation
linuxTemporarily disable Cooked Pro plugin until patched
wp plugin deactivate cooked-pro
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and Content Security Policy headers
- Educate administrators about CSRF risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Cooked Pro versionCheck Version:
wp plugin get cooked-pro --field=versionVerify Fix Applied:
Confirm Cooked Pro version is 1.8.0 or higher in WordPress plugins list📡 Detection & Monitoring
Log Indicators:
- Multiple failed administrative actions from same IP
- Unusual plugin configuration changes
Network Indicators:
- POST requests to wp-admin/admin-ajax.php without referrer headers
- Requests with unexpected plugin parameters
SIEM Query:
source="wordpress.log" AND "cooked-pro" AND ("admin-ajax" OR "wp-admin") AND status=200