CVE-2024-3552

What it actually does

CVE-2024-3552 is an unauthenticated SQL injection vulnerability in the Web Directory Free WordPress plugin before version 1.7.0. An AJAX action exposed through WordPress does not properly sanitize and escape a user-controlled parameter before including it in a SQL query. Because the vulnerable endpoint is reachable without authentication and the CVSS vector indicates network access, low complexity, and no user interaction, an attacker can inject SQL payloads using UNION-based, error-based, or time-based techniques. Successful exploitation can allow reading sensitive database contents, modifying or deleting records, creating or changing WordPress users, extracting password hashes or configuration data stored in the database, and potentially disrupting site availability through expensive or destructive queries.

Why it matters to the business

A public WordPress site using a vulnerable version of the Web Directory Free plugin may be fully compromised without an attacker needing credentials. The likely consequences include theft of user data, administrator account takeover, website defacement, spam or malware injection, search-engine blacklisting, outage from database corruption or resource exhaustion, and regulatory or contractual exposure if personal data is stored in the WordPress database. The risk is elevated because exploitation is weaponized, the vulnerability has a critical CVSS score of 9.8, and the EPSS score is high, indicating meaningful likelihood of exploitation in the wild even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies WordPress sites with the Web Directory Free plugin installed, commonly by checking publicly accessible plugin paths or plugin metadata. They then send crafted unauthenticated requests to the vulnerable WordPress AJAX endpoint, placing SQL syntax into the affected parameter. Initial probes often use quote characters, boolean conditions, sleep functions, or database error triggers to confirm injection. After confirmation, the attacker can enumerate database structure, extract WordPress user records and password hashes, retrieve sensitive plugin or site data, or modify database rows. In a full compromise scenario, the attacker may create or promote an administrator account, alter site content, inject malicious JavaScript, plant web-accessible PHP files through follow-on WordPress abuse, or damage availability by running expensive or destructive SQL statements.

How to fix it

Upgrade the Web Directory Free WordPress plugin to version 1.7.0 or later. If an upgrade is not immediately possible, disable and remove the plugin until it can be updated safely. Because the vulnerable AJAX action is unauthenticated, access control alone is not a reliable fix; however, as a temporary compensating control, deploy web application firewall rules to block SQL injection patterns against WordPress AJAX endpoints, especially requests to /wp-admin/admin-ajax.php containing UNION SELECT, SLEEP, BENCHMARK, SQL comments, or encoded SQL metacharacters. Review WordPress administrator accounts, rotate credentials, and consider rotating database credentials if exploitation is suspected. Maintain current backups and verify database integrity before and after remediation.

How to confirm the fix worked

Confirm that the installed Web Directory Free plugin version is 1.7.0 or later, or that the plugin is fully removed or disabled. In the WordPress admin interface, check the plugin version from the Plugins page; on disk, inspect the plugin directory metadata if filesystem access is available. Verify that public requests can no longer trigger SQL behavior through the vulnerable AJAX flow by testing only in an authorized environment with benign payloads and confirming no database errors, response-based injection behavior, or measurable time delays occur. Review WAF, web server, and application logs to ensure probes to /wp-admin/admin-ajax.php are blocked or no longer produce abnormal responses. If compromise is suspected, validate that no unexpected WordPress administrator accounts, unauthorized content changes, unknown PHP files, or suspicious database modifications remain.

Typical attack path

1. Scan the internet for WordPress sites that expose the Web Directory Free plugin or its static assets.
2. Confirm the target is running a vulnerable plugin version earlier than 1.7.0 where possible.
3. Send unauthenticated requests to the WordPress AJAX endpoint with SQL metacharacters or time-delay payloads in the vulnerable parameter.
4. Validate SQL injection using error messages, response differences, or delayed responses from functions such as SLEEP or BENCHMARK.
5. Use UNION-based, error-based, or blind/time-based SQL injection to enumerate database names, tables, columns, and WordPress user records.
6. Extract sensitive data such as user emails, password hashes, session-related data, plugin data, or site configuration stored in the database.
7. Optionally modify WordPress database records, such as creating or promoting an administrative user, changing site settings, or injecting malicious content.
8. Maintain access or monetize the compromise through spam, malware injection, phishing pages, credential theft, or denial of service.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from the web server, CDN, reverse proxy, and WAF for suspicious unauthenticated requests to WordPress AJAX endpoints, especially /wp-admin/admin-ajax.php, containing SQL syntax, encoded SQL metacharacters, or time-delay functions. Look for requests with parameters containing UNION SELECT, information_schema, SLEEP, BENCHMARK, OR 1=1, SQL comments, or unusually long encoded values. Correlate these events with 500 errors, database errors, long response times, spikes in PHP worker usage, or elevated database CPU. Review WordPress activity logs, if available, for new administrator users, password changes, plugin/theme editor activity, suspicious content edits, or unexpected option changes after suspicious requests. Inspect filesystem timestamps for recently created or modified PHP files in wp-content, plugin directories, theme directories, uploads, and cache locations. Review database logs, if enabled, for anomalous SELECTs against wp_users, schema enumeration through information_schema, unexpected UPDATEs to user roles or options, or expensive time-delay queries. If centralized logging retains request bodies, search POST bodies as well as URLs, since AJAX exploitation often sends parameters in POST data.

• /wp-admin/admin-ajax.php
• wp-content/plugins/web-directory-free/
• UNION SELECT
• union select
• information_schema
• SLEEP(
• sleep(
• BENCHMARK(
• benchmark(
• OR 1=1
• or 1=1
• ' OR '1'='1
• " OR "1"="1
• -- -
• #
• %27%20OR%20%271%27%3D%271
• %22%20OR%20%221%22%3D%221
• %55%4e%49%4f%4e%20%53%45%4c%45%43%54
• admin-ajax.php?action=

What your security team should do

• Immediately inventory WordPress sites for the Web Directory Free plugin and prioritize any version earlier than 1.7.0 for emergency remediation.
• Upgrade the plugin to version 1.7.0 or later, or remove it if it is not business-critical.
• Because exploit maturity is weaponized and EPSS is high, treat internet-facing vulnerable instances as likely targeted and perform compromise assessment, not just patch verification.
• Search historical web server, WAF, CDN, and WordPress logs for SQL injection attempts against /wp-admin/admin-ajax.php and plugin-related paths.
• Review WordPress users for newly created, renamed, or privilege-escalated administrator accounts after the vulnerability publication date.
• Inspect the webroot and plugin/theme directories for recently modified or unknown PHP files that could indicate post-exploitation webshell placement.
• Rotate WordPress administrator passwords and consider database credential rotation if logs show successful or likely exploitation.
• Add or tune WAF/SIEM detections for common SQL injection payloads in unauthenticated WordPress AJAX requests.
• Ensure reliable backups exist and test restoration procedures in case database tampering or destructive queries are discovered.