Hide Dashboard Notifications Vulnerability – Cross-Site Request Forgery – CVE-2024-33683 | WordPress Plugin Vulnerability Report 

Plugin Name: Hide Dashboard Notifications

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-hide-backed-notices
  • Software Status: Active
  • Software Author: wprepublic
  • Software Downloads: 168,065
  • Active Installs: 30,000
  • Last Updated: May 10, 2024
  • Patched Versions: 1.3
  • Affected Versions: <= 1.2.3

Vulnerability Details:

  • Name: Hide Dashboard Notifications <= 1.2.3
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-33683
  • CVSS Score: 4.3
  • Publicly Published: April 26, 2024
  • Researcher: Dhabaleshwar Das
  • Description: The Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.3. This vulnerability arises from missing or incorrect nonce validation in the warning_notices_settings() function, allowing unauthenticated attackers to modify notice settings via a forged request if they can trick a site administrator into clicking a link.


The Hide Dashboard Notifications plugin for WordPress has a vulnerability in versions up to and including 1.2.3 that exposes sites to potential unauthorized modifications of notice settings through Cross-Site Request Forgery (CSRF). This vulnerability has been patched in version 1.3.

Detailed Overview:

Dhabaleshwar Das discovered a significant security flaw in the Hide Dashboard Notifications plugin, specifically in the function responsible for managing notice settings. The vulnerability is due to insufficient nonce validation, a security mechanism intended to protect against CSRF attacks. By exploiting this vulnerability, an attacker can potentially manipulate the plugin settings without proper authorization, provided they can deceive an administrator into interacting with a malicious link. The risk associated with this vulnerability is primarily unauthorized configuration changes, which, while not directly leading to data theft or loss, could be used as part of broader attack strategies. The plugin developers have addressed this issue in the patched version 1.3, ensuring that nonce validation is appropriately implemented.


The quick response by the Hide Dashboard Notifications plugin developers to remedy this vulnerability demonstrates the critical importance of maintaining current updates and monitoring security advisories. Users are strongly encouraged to update their installations to version 1.3 or later to safeguard their WordPress sites against this CSRF vulnerability.


Detailed Report: 

In the digital realm where security is paramount, the maintenance and timely updating of your website play a critical role in safeguarding your online presence. A recent discovery has brought to light a critical vulnerability in the popular WordPress plugin, "Hide Dashboard Notifications," which has put numerous websites at risk of unauthorized access and modification. This vulnerability not only highlights the importance of regular updates but also serves as a reminder of the potential consequences of overlooking website security, particularly for small business owners juggling numerous responsibilities.

Impact of the Vulnerability:

The CSRF vulnerability within the Hide Dashboard Notifications plugin could lead to unauthorized changes to website settings, potentially disrupting the normal functionality of your site. Although it may not directly result in data theft, such alterations can pave the way for more severe attacks if not addressed promptly.

How to Address the Vulnerability:

  • Immediate Action: Update to the patched version 1.3 immediately to mitigate the risk.
  • Check for Signs of Compromise: Regularly review your plugin settings for any unauthorized changes and monitor activity logs for any suspicious actions.
  • Consider Alternatives: While the patched version is deemed secure, exploring alternative plugins that fulfill similar functions can serve as a precautionary measure.
  • Stay Updated: Continuously ensure that all plugins and your core WordPress installation are up-to-date to protect against known vulnerabilities.

Overview of Previous Vulnerabilities:

The rapid resolution of this vulnerability by the plugin developers is a testament to their commitment to security. However, this incident serves as a crucial reminder of the ongoing risks associated with digital tools and the necessity of remaining vigilant by applying security patches without delay.


For small business owners, the task of maintaining a secure website can often be daunting given the myriad of other responsibilities. Yet, the security of your online assets is fundamental to protecting not just your business's data but also your reputation. Leveraging managed WordPress hosting services or engaging with professionals to regularly check and update your website's security can be a worthwhile investment. Remember, staying proactive about security vulnerabilities is not just about fixing a problem; it's about preventing potential crises before they arise.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Hide Dashboard Notifications Vulnerability – Cross-Site Request Forgery – CVE-2024-33683 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment