CVE-2024-8624
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3. This vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. It affects authenticated users with Contributor-level access and above, allowing them to append additional SQL queries to existing queries.
Impact
This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious SQL queries, potentially leading to unauthorized access, modification, or deletion of sensitive data stored in the WordPress database. The impact is severe, with high risks to the confidentiality, integrity, and availability of the affected systems. Attackers could extract sensitive information, manipulate database contents, or potentially escalate their privileges within the WordPress installation.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A specific patch is not explicitly mentioned in the provided information. The vulnerability affects all versions of the MDTF – Meta Data and Taxonomies Filter plugin for WordPress up to and including version 1.3.3.3. Users should look for updates beyond version 1.3.3.3 or consider alternative mitigation strategies until a patch becomes available.
Mitigation
1. Temporarily disable the MDTF – Meta Data and Taxonomies Filter plugin if it's not critical for operations. 2. Implement strong access controls to limit the number of users with Contributor-level access or higher. 3. Use Web Application Firewall (WAF) rules to detect and block SQL injection attempts. 4. Regularly audit and monitor database activities for suspicious queries or unauthorized access attempts. 5. Keep WordPress core, themes, and other plugins up-to-date to minimize overall vulnerability exposure. 6. Consider upgrading to a version newer than 1.3.3.3 if available, or look for security announcements from the plugin developer.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2024-8624. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-8624
A CVSS base score of 9.9 has been assigned.
Detection for the vulnerability has been added to Qualys (152232)
EPSS Score was set to: 0.05% (Percentile: 20%)
Detection for the vulnerability has been added to Qualys (152237)
CVE-2024-8624 is a critical SQL Injection vulnerability with a CVSS score of 9.1 affecting the MDTF – Meta Data and Taxonomies Filter plugin for WordPress, present in all versions up to 1.3.3.3. This vulnerability allows authenticated attackers with Contributor-level access to extract sensitive information from the database. The summary does not provide information on exploitation in the wild, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts. See article