WordPress Insertify plugin <= 1.1.4 - CSRF to Remote Code Execution vulnerability

The impact of this RCE vulnerability is severe. A successful exploit allows an attacker to execute arbitrary code on the WordPress server hosting the Insertify plugin. This could lead to complete website takeover, data theft, defacement, or the installation of malware. Given the plugin's functionality (inserting content), an attacker could potentially inject malicious code into the website's database or modify core files, leading to widespread compromise. The CSRF aspect means an attacker doesn't necessarily need to authenticate to exploit the vulnerability, making it particularly dangerous.

Websites using the Insertify plugin, particularly those with vulnerable versions (≤1.1.4), are at significant risk. Shared hosting environments are especially vulnerable as they often have limited control over plugin updates. WordPress sites with weak CSRF protection are also at increased risk.

• wordpress / composer / npm:

grep -r 'insertify_plugin_url' /var/www/html/*

• wordpress / composer / npm:

wp plugin list --status=inactive | grep Insertify

• wordpress / composer / npm:

wp plugin update --all

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/insertify/ | grep -i 'insertify'

1. 2024-12-16Disclosure

   disclosure

1. Reserviert2024-12-02
2. Veröffentlicht2024-12-16
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-54372 is to immediately upgrade the Insertify plugin to version 1.1.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the Insertify plugin to prevent exploitation. While a direct WAF rule is difficult to implement due to the CSRF nature, implementing strict CSRF protection on all WordPress admin endpoints is a general best practice. Regularly review WordPress plugin installations and ensure they are from trusted sources.