CVE-2024-6490
📋 TL;DR
This CSRF vulnerability in the Master Slider WordPress plugin allows attackers to trick authenticated administrators into unknowingly submitting malicious requests that delete all sliders. It affects WordPress sites using Master Slider plugin versions up to 3.9.10. Attackers can exploit this by luring administrators to malicious web pages while logged into their WordPress dashboard.
💻 Affected Systems
- Master Slider WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
All Master Slider content is permanently deleted, causing website functionality loss and requiring restoration from backups.
Likely Case
Attackers delete slider content, disrupting website appearance and functionality until restoration.
If Mitigated
With proper CSRF protections, the attack fails and no sliders are deleted.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated administrators.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.11 or later
Vendor Advisory: https://wpscan.com/vulnerability/5a56e5aa-841d-4be5-84da-4c3b7602f053/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Master Slider and click 'Update Now'. 4. Verify version is 3.9.11 or higher.
🔧 Temporary Workarounds
CSRF Protection via WordPress Nonce
allAdd CSRF protection to Master Slider delete functionality
Requires code modification - not recommended for non-developers
Restrict Administrator Access
allLimit administrator access to trusted networks only
🧯 If You Can't Patch
- Disable Master Slider plugin temporarily
- Implement web application firewall with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Master Slider versionCheck Version:
wp plugin list --name='master-slider' --field=versionVerify Fix Applied:
Confirm Master Slider version is 3.9.11 or higher in WordPress plugins list📡 Detection & Monitoring
Log Indicators:
- Multiple slider delete requests from same administrator session
- Unusual POST requests to master-slider admin endpoints
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with action=delete_slider
- Referer headers pointing to external domains
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND post_data CONTAINS "delete_slider")