CVE-2021-24862

What it actually does

CVE-2021-24862 is a SQL injection vulnerability in the RegistrationMagic WordPress plugin before version 5.0.1.6. The vulnerable rm_chronos_ajax AJAX action fails to properly escape user-supplied input before using it in a SQL query when duplicating tasks in batches. Because the CVSS vector indicates high privileges are required, exploitation generally requires access to an authenticated WordPress account with sufficient permissions to reach the vulnerable AJAX functionality. Successful exploitation can allow an attacker to alter the intended SQL query, potentially reading sensitive database contents, modifying data, or disrupting database-backed application functionality.

Why it matters to the business

A compromised privileged WordPress account could be used to extract or manipulate website data stored in the WordPress database, including user records, form submissions, registration data, and site configuration. For organizations that rely on RegistrationMagic for user registration or form workflows, exploitation could lead to data exposure, fraudulent changes, operational disruption, and incident response costs. Although this vulnerability is not currently listed in CISA KEV and is not flagged as ransomware-used, its EPSS score is high and exploit maturity is listed as weaponized, so exposed installations should be treated as a priority, especially because the issue has been public for several years.

How an attack unfolds

An attacker first obtains valid WordPress credentials with sufficient privileges to access RegistrationMagic administrative or task-management AJAX functionality. They then send a crafted request to the WordPress AJAX endpoint invoking the rm_chronos_ajax action used during batch task duplication. By placing SQL metacharacters or a payload into the vulnerable parameter processed by that action, the attacker causes the plugin to concatenate attacker-controlled input into a database query. Depending on the database privileges available to WordPress and the exact query context, the attacker may enumerate database structure, extract sensitive data, alter plugin or WordPress records, create persistence through database changes, or trigger database errors and availability issues. Weaponized exploitation means defenders should assume reliable exploit patterns may exist even when public proof-of-concept details vary.

How to fix it

Upgrade the RegistrationMagic WordPress plugin to version 5.0.1.6 or later. If a fixed version is not available through normal WordPress update channels, obtain the latest release directly from the vendor or temporarily disable and remove the plugin until it can be safely updated. Restrict WordPress administrative access to trusted users, enforce MFA for privileged accounts, and review roles to ensure only necessary users can access plugin management functions. As compensating controls, block or tightly monitor authenticated requests to /wp-admin/admin-ajax.php using action=rm_chronos_ajax, deploy WAF rules for SQL injection patterns, and ensure the WordPress database account has only the permissions required by the application.

How to confirm the fix worked

Confirm the installed RegistrationMagic plugin version is 5.0.1.6 or later by checking the WordPress plugin administration page, wp-content/plugins plugin metadata, or WP-CLI plugin inventory. Verify that the vulnerable AJAX action is no longer exploitable by reviewing the updated plugin code for proper input validation and prepared SQL statements around rm_chronos_ajax task duplication logic. Use authenticated security testing in a non-production environment to confirm SQL injection payloads are rejected or safely handled. Review web server and application logs for prior requests to admin-ajax.php with action=rm_chronos_ajax, especially requests containing SQL metacharacters, UNION/SELECT/SLEEP payloads, URL-encoded SQL syntax, or abnormal response times.

Typical attack path

1. Identify a WordPress site running the RegistrationMagic plugin.
2. Confirm the plugin version is older than 5.0.1.6 or otherwise vulnerable.
3. Obtain or compromise a WordPress account with sufficient privileges to access the vulnerable RegistrationMagic AJAX workflow.
4. Send a crafted authenticated request to /wp-admin/admin-ajax.php using the rm_chronos_ajax action.
5. Inject SQL syntax into the vulnerable task-duplication parameter handled by the plugin.
6. Use database responses, timing behavior, or application errors to confirm injection.
7. Extract, modify, or destroy WordPress and plugin data depending on access and attacker objectives.
8. Optionally make database-backed changes to maintain access or conceal activity.

How to detect it

To assess prior exploitation, review HTTP access logs, WAF events, WordPress activity logs, authentication logs, and database logs for authenticated requests to /wp-admin/admin-ajax.php where the action parameter is rm_chronos_ajax. Focus on requests containing SQL injection syntax such as UNION SELECT, information_schema, SLEEP, BENCHMARK, single quotes, comments, or URL-encoded equivalents. Correlate suspicious requests with WordPress login events, privilege changes, new administrator users, plugin/theme edits, and unusual database activity. Check for large or repeated POST requests to admin-ajax.php, abnormal 500 responses, database error messages, unusually long request durations, and requests from unfamiliar IP addresses using privileged sessions. Because exploitation requires high privileges, also investigate compromised admin accounts, unexpected session activity, and any database modifications around the time of suspicious AJAX requests.

• /wp-admin/admin-ajax.php
• action=rm_chronos_ajax
• rm_chronos_ajax
• UNION SELECT
• UNION%20SELECT
• information_schema
• SLEEP(
• SLEEP%28
• BENCHMARK(
• BENCHMARK%28
• ' OR '1'='1
• %27%20OR%20%271%27%3D%271
• --
• %2D%2D
• /*
• %2F%2A
• SQL syntax
• You have an error in your SQL syntax
• wp-content/plugins/registrationmagic

What your security team should do

• Inventory all WordPress sites for the RegistrationMagic plugin and identify any versions earlier than 5.0.1.6.
• Patch or remove vulnerable RegistrationMagic installations as a priority due to weaponized exploit maturity and high EPSS likelihood.
• Audit WordPress privileged accounts, reset credentials where suspicious activity is found, and enforce MFA for administrators and plugin managers.
• Search historical web server, WAF, and WordPress logs for exploitation attempts targeting /wp-admin/admin-ajax.php with action=rm_chronos_ajax.
• Review the WordPress database for unauthorized administrator accounts, unexpected option changes, suspicious plugin/theme modifications, and anomalous RegistrationMagic records.
• Add SIEM/WAF detections for authenticated SQL injection payloads against WordPress AJAX endpoints, especially rm_chronos_ajax.
• Ensure backups are recent and restorable before patching, and preserve logs if exploitation is suspected.