CVE-2024-37237 is a Cross-Site Request Forgery (CSRF) vulnerability found in the FS Poster plugin developed by fs-code, affecting all versions up to and including 6.5.8. FS Poster is a WordPress plugin designed to automate social media posting across multiple platforms. The CSRF vulnerability allows an attacker to craft malicious web requests that, when visited by an authenticated FS Poster user, can trigger unauthorized actions within the plugin without the user's consent or knowledge. This occurs because the plugin fails to properly verify the origin or authenticity of state-changing requests, lacking adequate anti-CSRF tokens or similar protections. The vulnerability does not require the attacker to have direct access to the victim's credentials but does require the victim to be logged into the WordPress site with FS Poster installed. There are no known public exploits or active attacks reported at this time, but the vulnerability is publicly disclosed and could be weaponized by attackers targeting organizations relying on FS Poster for social media automation. The absence of a CVSS score indicates the need for an independent severity assessment. The vulnerability primarily threatens the integrity and availability of the plugin's functionality, as unauthorized commands could disrupt scheduled posts or manipulate social media content. Confidentiality impact is minimal since the attack vector does not inherently expose sensitive data. The scope is limited to WordPress sites using FS Poster, but given the plugin's role in social media management, the potential operational impact is significant. The vulnerability was reserved in June 2024 and published in January 2025, with no patches currently linked, indicating users should seek updates or implement manual mitigations.

The primary impact of CVE-2024-37237 is on the integrity and availability of social media posting operations managed through the FS Poster plugin. An attacker exploiting this CSRF vulnerability can cause unauthorized actions such as posting, deleting, or modifying scheduled social media content without the user's consent. This can lead to reputational damage, misinformation dissemination, or disruption of marketing campaigns for organizations relying on FS Poster. While confidentiality is less affected, the unauthorized control over social media posts can indirectly affect trust and brand image. Organizations with automated social media workflows are at risk of operational disruption. The vulnerability requires the victim to be authenticated, which limits the attack surface but does not eliminate risk, especially in environments with many users or where users have elevated privileges. The lack of known exploits in the wild reduces immediate risk but does not preclude future attacks. Overall, the vulnerability could be leveraged in targeted attacks against businesses, media agencies, or any entity using FS Poster to manage social media presence.

To mitigate CVE-2024-37237, organizations should immediately check for and apply any official patches or updates released by fs-code for FS Poster. If no patch is available, implement manual mitigations such as adding anti-CSRF tokens to all state-changing requests within the plugin or using web application firewalls (WAFs) to detect and block suspicious CSRF attempts. Restrict FS Poster user permissions to the minimum necessary to reduce the impact of a compromised account. Educate users to avoid clicking on suspicious links while authenticated to WordPress sites running FS Poster. Monitor logs for unusual activity related to social media posting actions. Additionally, consider isolating or limiting access to the WordPress admin interface via IP whitelisting or VPN access to reduce exposure. Regularly audit plugin configurations and user roles to ensure least privilege principles are enforced. Finally, maintain a robust incident response plan to quickly address any signs of exploitation.