Vulnerability record · CVE-2024-3552 · published 13 June 2024
CVE-2024-3552: Web Directory Free WordPress plugin SQL injection via unauthenticated AJAX
Salephpscripts · Web Directory Free
The Web Directory Free WordPress plugin before 1.7.0 fails to sanitise and escape a parameter before using it in a SQL statement through an AJAX action reachable by unauthenticated users. This allows SQL injection using UNION, time-based and error-based techniques. With a CVSS base score of 9.8 and an EPSS probability above 0.67, it is a high-value target for mass scanning.
Description
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable SQL injection with a 9.8 CVSS score, public exploit references and very high EPSS probability makes this an urgent patch.
What it is
The Web Directory Free WordPress plugin before 1.7.0 fails to sanitise and escape a parameter before using it in a SQL statement through an AJAX action reachable by unauthenticated users. This allows SQL injection using UNION, time-based and error-based techniques. With a CVSS base score of 9.8 and an EPSS probability above 0.67, it is a high-value target for mass scanning.
Impact
An attacker can read, modify or delete data in the WordPress database, including user credentials and site content, and may be able to execute further database-level actions depending on privileges. Full confidentiality, integrity and availability impact is scored.
Attack surface
Reached over the network through a WordPress AJAX action that requires no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-facing site running an affected plugin version is exposed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.6706 (99.26th percentile) and both references are tagged Exploit, indicating public exploit code and active interest.
What to do
- Update the Web Directory Free plugin to version 1.7.0 or later immediately.
- If patching is not possible, disable or remove the plugin until it can be updated.
- Deploy a WAF rule blocking SQL injection patterns against the plugin's AJAX endpoints.
- Restrict access to wp-admin/admin-ajax.php where feasible and monitor for anomalous requests.
- Audit the database and WordPress users for signs of tampering after exposure.
Detection
- Search web logs for requests to admin-ajax.php with SQL metacharacters, UNION, SLEEP or BENCHMARK in parameters.
- Alert on time-based patterns such as repeated delayed responses from the same source to AJAX endpoints.
- Monitor database error responses or unusual query volume originating from the web tier.
- Review WordPress audit logs for unexpected data changes or new administrative users.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/ | ExploitThird Party Advisory |
| https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/ | ExploitThird Party Advisory |
Track CVE-2024-3552 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-3552), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
