CVE-2024-0379

MEDIUM

Custom Twitter Feeds < 2.2.1 - Cross-Site Request Forgery via ctf_auto_save_tokens Function

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-0379. PoCs published by kodaichodai.

AI-analyzed exploit summary This is a functional CSRF PoC for CVE-2024-0379, targeting a WordPress admin-ajax.php endpoint with a crafted form submission. The exploit leverages a missing CSRF token validation to perform unauthorized actions via the 'ctf_auto_save_tokens' action.

Description

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function. This makes it possible for unauthenticated attackers to update the site's twitter API token and secret via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Exploits (1)

nomisec WORKING POC
by kodaichodai · poc
https://github.com/kodaichodai/CVE-2024-0379

This is a functional CSRF PoC for CVE-2024-0379, targeting a WordPress admin-ajax.php endpoint with a crafted form submission. The exploit leverages a missing CSRF token validation to perform unauthorized actions via the 'ctf_auto_save_tokens' action.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress (specific version not specified)
No auth needed
Prerequisites: Victim must visit the malicious page while authenticated to WordPress
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 4.3
EPSS 0.0101
EPSS Percentile 58.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
smashballoon/custom_twitter_feeds < 2.2.2
smub/Custom Twitter Feeds – A Tweets Widget or X Feed Widget < 2.2.1
Published Feb 29, 2024
Tracked Since Feb 18, 2026