CVE-2024-9598
📋 TL;DR
This CSRF vulnerability in the AMP for WordPress plugin allows attackers to steal logged-in users' cookies by tricking administrators into clicking malicious links. All WordPress sites using AMP for WP plugin versions up to 1.0.99.1 are affected. The attack requires social engineering but no authentication.
💻 Affected Systems
- AMP for WP – Accelerated Mobile Pages WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Site administrator session hijacking leading to complete WordPress compromise, data theft, and website defacement.
Likely Case
Administrator cookie theft enabling unauthorized access to WordPress admin panel.
If Mitigated
No impact if proper CSRF protections are implemented or plugin is updated.
🎯 Exploit Status
Exploitation requires social engineering to trick administrator into clicking malicious link.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.99.2 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3174071/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'AMP for WP – Accelerated Mobile Pages'. 4. Click 'Update Now' if available, or manually update to version 1.0.99.2+.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable AMP for WP plugin until patched
wp plugin deactivate accelerated-mobile-pages
Implement CSRF protection headers
linuxAdd security headers to WordPress .htaccess or web server config
Header set X-Frame-Options "DENY"
Header set Content-Security-Policy "frame-ancestors 'none'"
🧯 If You Can't Patch
- Restrict admin access to trusted IP addresses only
- Implement mandatory multi-factor authentication for all administrator accounts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → AMP for WP version. If version is 1.0.99.1 or lower, you are vulnerable.Check Version:
wp plugin get accelerated-mobile-pages --field=versionVerify Fix Applied:
Verify plugin version is 1.0.99.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with action=ampforwp_proxy
- Multiple failed admin login attempts followed by successful login from new IP
Network Indicators:
- Outbound connections from WordPress server to unknown domains after admin actions
- Suspicious referrer headers in admin area requests
SIEM Query:
source="wordpress.log" AND (uri="/wp-admin/admin-ajax.php" AND parameters.action="ampforwp_proxy")