Security readout for executives and security teams
Plain-English summary
This vulnerability affects the WordPress Regenerate post permalink plugin through version 1.0.3. An attacker could trick a logged-in site user into taking an unintended action that leads to cross-site scripting. That can expose data, alter content, or disrupt site behavior. The provided sources do not show active exploitation.
Executive priority
Treat this as a high-priority WordPress plugin exposure review, not an emergency KEV-driven incident. Organizations running the affected plugin should identify usage quickly, remove or remediate unsupported installations, and monitor for suspicious content changes.
Technical view
CVE-2024-33681 is a CWE-352 CSRF issue in Sandor Kovacs Regenerate post permalink for WordPress, affecting versions through 1.0.3. The CVSS 3.1 score is 7.1 high, with network attack vector, low complexity, no attacker privileges, required user interaction, changed scope, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to WordPress sites with the regenerate-post-permalinks plugin installed at version 1.0.3 or earlier. Risk is higher where privileged WordPress users browse while authenticated. The source bundle does not identify affected hosted services, managed WordPress platforms, or a fixed version.
Exploitation context
The vulnerability requires user interaction, consistent with a CSRF scenario where a victim is induced to perform an action while authenticated. The bundle says CSRF can lead to XSS, but does not specify stored versus reflected XSS. CISA KEV status is false, and no cited source confirms exploitation in the wild.
Researcher notes
Evidence is limited to CVE and Patchstack metadata. The public bundle confirms CSRF leading to XSS, affected versions through 1.0.3, CVSS 7.1, and CWE-352. It does not provide exploit details, proof-of-concept status, fixed-version data, or observed exploitation.
Mitigation direction
- Inventory WordPress sites for the Regenerate post permalink plugin version 1.0.3 or earlier.
- Check Patchstack and vendor guidance for an official fixed release or remediation.
- If no maintained fix is available, disable and remove the plugin from production sites.
- Limit privileged WordPress sessions and avoid browsing untrusted sites while authenticated.
- Monitor posts, permalinks, and page content for unexpected script or content changes.
Validation and detection
- Confirm plugin presence and version across all WordPress instances.
- Review the Patchstack entry and vendor release notes for remediation status.
- Verify any deployed plugin version is newer than the affected range, if a fixed version exists.
- Check WordPress logs and content history for unexpected permalink or post modifications.
- Confirm state-changing admin actions require valid anti-CSRF protection.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-33681 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.