WordPress Post Title (TypeWriter) and Flash News / Post (Responsive) plugins <= 4.1 - CSRF to Privilege Escalation vulnerability

The CSRF vulnerability allows an attacker to trick a legitimate user into unknowingly executing malicious actions on a WordPress site. For example, an attacker could craft a malicious link or embed it in a website that, when clicked by an authenticated user, could modify plugin settings, create or delete posts, or perform other administrative actions. This could lead to unauthorized content publication, website defacement, or even complete compromise of the WordPress installation, depending on the permissions associated with the affected user. The CRITICAL CVSS score reflects the ease of exploitation and the potential for significant impact.

WordPress websites utilizing Pearlbells Flash News / Post (Responsive) or Pearlbells Post Title (TypeWriter) plugins, particularly those running older versions (≤4.1), are at significant risk. Shared hosting environments where plugin updates are not managed centrally are especially vulnerable, as are sites with administrative users who frequently click on links from untrusted sources.

• wordpress / composer / npm:

grep -r 'pearlbells_flash_news' /var/www/html/wp-content/plugins/
wp plugin list | grep pearlbells

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=pearlbells_flash_news_save_settings&nonce=malicious_nonce

1. 2024-12-16Disclosure

   disclosure

1. Réservé2024-12-14
2. Publiée2024-12-16
3. Modifiée2025-01-27
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-56012 is to immediately upgrade Pearlbells Flash News / Post (Responsive) and Pearlbells Post Title (TypeWriter) plugins to version 4.1.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious requests containing CSRF tokens. WordPress plugins like Wordfence can help with this. Additionally, ensure users are educated about the risks of clicking on untrusted links and entering credentials on unfamiliar websites. After upgrading, verify the fix by attempting to trigger a plugin action via a crafted CSRF request and confirming that it fails.