Page Restrict CVE-2024-24702
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CSRF requires no attacker privileges (PR:N) but mandatory admin victim interaction (UI:R); full plugin control justifies C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5.
AnalysisAI
Cross-Site Request Forgery in the Page Restrict WordPress plugin (versions through 2.5.5) allows unauthenticated remote attackers to trigger privileged admin-level actions by luring an authenticated site administrator to a malicious page. The plugin, which controls content access restrictions across a WordPress site, lacks CSRF token validation on its administrative endpoints, meaning any admin-authenticated browser session can be silently weaponized. No public exploit code or active exploitation has been identified at time of analysis, though the attack mechanism is a well-understood class requiring only social engineering against an admin user.
Technical ContextAI
Page Restrict is a WordPress plugin (CPE: cpe:2.3:a:sivel:pagerestrict:*:*:*:*:*:wordpress:*:*) authored by Matt Martz and Andy Stratton that controls which pages or posts are accessible to logged-in users versus the public. The root cause is CWE-352 (Cross-Site Request Forgery), where the plugin's state-changing administrative request handlers do not verify that requests originate from the legitimate WordPress admin interface. WordPress itself provides nonce-based CSRF protection that plugins must explicitly implement; failure to do so means any crafted HTTP form or JavaScript fetch submitted from a third-party page will be accepted as legitimate when executed in an admin's browser session. The vulnerability was reported by Patchstack's audit team and published in the NVD-linked Patchstack advisory.
RemediationAI
The primary remediation is to update the Page Restrict plugin to a version beyond 2.5.5; consult the Patchstack advisory at https://patchstack.com/database/vulnerability/pagerestrict/wordpress-page-restrict-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability for confirmed patched version details, as no exact fixed version number is independently confirmed from the available input data. If an immediate update is not possible, administrators should restrict access to the WordPress admin dashboard to trusted IP ranges using server-level controls (e.g., nginx or Apache location blocks, or a WAF rule targeting wp-admin), which prevents an attacker-crafted page from reaching admin-authenticated endpoints even if an admin visits the malicious URL. A secondary compensating control is user training: administrators should avoid browsing untrusted sites while logged in to WordPress, and should log out of the admin session when not actively managing the site. Disabling the plugin entirely until patched is the most conservative workaround if page restriction functionality is non-critical.
More in Pagerestrict
View allSame weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today