CVE-2021-24762

What it actually does

The Perfect Survey WordPress plugin before version 1.5.2 passes the unauthenticated GET parameter `question_id` from the `get_question` AJAX action into a SQL query without proper validation, parameterization, or escaping. Because the vulnerable endpoint is reachable over the network without authentication or user interaction, an attacker can inject SQL syntax into the parameter and cause the WordPress database to execute attacker-controlled queries. Depending on database permissions and server configuration, this can expose sensitive data, modify site content or plugin data, create or alter WordPress users, extract password hashes or session-related data, and potentially support further compromise of the site.

Why it matters to the business

A vulnerable public WordPress site can be compromised remotely without login credentials, creating a high risk of data theft, website defacement, malicious administrator account creation, SEO spam injection, customer trust loss, regulatory exposure, and operational downtime. The high CVSS score, high EPSS probability, and weaponized exploit maturity indicate this should be treated as an urgent internet-facing WordPress risk even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies WordPress sites with the Perfect Survey plugin installed, commonly by fingerprinting plugin assets under `/wp-content/plugins/` or by probing the WordPress AJAX endpoint. They then send crafted unauthenticated requests to `/wp-admin/admin-ajax.php` using the vulnerable `action=get_question` handler and a malicious `question_id` value containing SQL injection syntax. Initial requests may test for SQL errors, timing differences, or boolean response changes. Once confirmed, the attacker can automate extraction of database contents such as WordPress user records, password hashes, email addresses, survey data, configuration values, and plugin data. If the database account permits writes, the attacker may modify WordPress options, inject malicious content, create privileged users indirectly through database manipulation, or prepare the site for webshell upload through follow-on abuse of WordPress admin access or stolen credentials.

How to fix it

Upgrade the Perfect Survey WordPress plugin to version 1.5.2 or later. If an upgrade is not immediately possible, disable and remove the plugin until it can be updated. Restrict direct access to `/wp-admin/admin-ajax.php` only where operationally feasible, but do not rely on access controls as the primary fix because this endpoint is commonly required by WordPress functionality. Ensure the WordPress database user has least-privilege permissions and does not have unnecessary administrative capabilities. After patching, rotate WordPress administrator passwords and review administrator accounts if there is any indication the vulnerable endpoint was exposed to the internet while unpatched.

How to confirm the fix worked

Confirm the installed Perfect Survey plugin version is 1.5.2 or later from the WordPress administrative plugin inventory, filesystem plugin metadata, or software composition inventory. Verify the vulnerable plugin is not present in inactive plugin directories, backups, staging copies, or cloned WordPress deployments. Test exposure by confirming requests to `/wp-admin/admin-ajax.php?action=get_question` no longer process unvalidated SQL-like `question_id` input and do not return SQL errors, timing differences, or abnormal responses. Review web server and application logs for historical requests containing `action=get_question` and suspicious SQL metacharacters or functions in the `question_id` parameter.

Typical attack path

1. Scan the internet for WordPress sites exposing Perfect Survey plugin assets or AJAX behavior.
2. Send unauthenticated requests to `/wp-admin/admin-ajax.php` with `action=get_question`.
3. Inject SQL payloads into the `question_id` GET parameter.
4. Confirm exploitability using SQL error messages, boolean-based response changes, or time-based delays.
5. Enumerate database metadata and extract WordPress user, option, and plugin-related tables.
6. Use stolen hashes, credentials, or writable database access to escalate control of the WordPress site.
7. Persist by creating unauthorized administrator access, modifying site content, or staging malware through follow-on compromise.

How to detect it

Review HTTP access logs, WAF logs, CDN logs, reverse proxy logs, and WordPress security plugin logs for requests to `/wp-admin/admin-ajax.php` where `action=get_question` is present and `question_id` contains SQL injection syntax. Look for URL-encoded quotes, comments, UNION queries, sleep/time-delay functions, boolean probes, database metadata table names, and repeated automated requests from the same source. Investigate HTTP 500 responses, SQL error messages, unusually long response times, and large response bodies associated with this AJAX action. In database logs, look for anomalous queries involving WordPress tables that contain injected operators, UNION clauses, or time-delay functions shortly after web requests to the vulnerable endpoint. For post-exploitation, inspect WordPress administrator account creation, changes to `wp_options`, unknown plugins/themes, modified PHP files, webshell-like files, suspicious cron entries, and unexpected outbound connections from the web server.

• /wp-admin/admin-ajax.php?action=get_question
• action=get_question&question_id=
• question_id=%27
• question_id='
• question_id=%22
• question_id="
• question_id=*
• question_id=0%20UNION%20SELECT
• question_id=1%20UNION%20SELECT
• question_id=%20UNION%20ALL%20SELECT
• question_id=%20OR%201=1
• question_id=%27%20OR%20%271%27=%271
• question_id=1%20AND%20SLEEP(
• question_id=1%20AND%20BENCHMARK(
• question_id=%20WAITFOR%20DELAY
• information_schema.tables
• information_schema.columns
• wp_users
• wp_options
• /wp-content/plugins/perfect-survey/
• SQL syntax
• You have an error in your SQL syntax
• mysql_fetch
• mysqli_fetch
• database error

What your security team should do

• Prioritize patching or disabling Perfect Survey on all internet-facing WordPress sites because exploitation is weaponized and EPSS is high.
• Inventory WordPress installations for the Perfect Survey plugin, including inactive plugins and development or staging sites reachable from the internet.
• Upgrade to Perfect Survey 1.5.2 or later, or remove the plugin where it is not business-critical.
• Search historical web logs for exploitation attempts against `admin-ajax.php` using `action=get_question` and malicious `question_id` values.
• If exploitation is suspected, perform WordPress incident response: review administrator accounts, recent plugin/theme changes, modified PHP files, suspicious scheduled tasks, and database changes.
• Place temporary WAF rules in front of unpatched systems to block SQL injection patterns in `question_id`, while treating this only as a short-term compensating control.
• Harden WordPress by enforcing MFA for administrators, limiting plugin installation rights, keeping all plugins updated, and monitoring for file integrity changes.