CVE-2024-6024
📋 TL;DR
This vulnerability in the ContentLock WordPress plugin allows attackers to trick logged-in administrators into deleting groups or emails without their consent. Attackers can craft malicious requests that appear legitimate, exploiting the lack of CSRF protection. All WordPress sites using vulnerable versions of ContentLock are affected.
💻 Affected Systems
- ContentLock WordPress Plugin
📦 What is this software?
Contentlock by Adamsolymosi
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete all groups and email configurations, disrupting content access controls and potentially causing data loss or service disruption.
Likely Case
Targeted deletion of specific groups or email addresses, compromising content access management and requiring administrative recovery.
If Mitigated
With proper CSRF tokens and user confirmation dialogs, the risk is eliminated as requests require explicit user intent.
🎯 Exploit Status
Exploitation requires social engineering to trick an admin into clicking a malicious link while authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4 or later
Vendor Advisory: https://wpscan.com/vulnerability/3d2cdb4f-b7e1-4691-90d1-cddde7f5858e/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find ContentLock and click 'Update Now'. 4. Verify update to version 1.0.4 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable ContentLock plugin until patched to prevent exploitation.
wp plugin deactivate contentlock
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block CSRF attempts targeting ContentLock endpoints.
- Educate administrators about phishing risks and require multi-step confirmation for sensitive actions.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for ContentLock version 1.0.3 or earlier.Check Version:
wp plugin get contentlock --field=versionVerify Fix Applied:
Confirm ContentLock version is 1.0.4 or higher in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual DELETE requests to /wp-admin/admin-ajax.php with action parameters related to ContentLock groups/emails
- Multiple group/email deletion events from single admin session
Network Indicators:
- HTTP POST requests to admin endpoints without Referer headers matching site domain
- Suspicious redirects or iframes targeting admin users
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php") AND (http_method="POST") AND (form_data CONTAINS "action=contentlock_delete")