CVE-2024-3552

Deeper analysis

The Web Directory Free WordPress plugin before version 1.7.0 is affected by an unauthenticated SQL injection vulnerability tracked as CVE-2024-3552. The root cause is missing sanitization and escaping of a parameter that is concatenated into a SQL statement inside an AJAX action reachable without authentication, enabling attackers to use UNION, Time-Based, and Error-Based injection techniques. The flaw is classified under CWE-89 and carries a CVSS 3.1 score of 9.8.

An unauthenticated remote attacker can send crafted requests to the exposed AJAX endpoint and extract, modify, or delete database contents, potentially leading to full site takeover. Because the action requires no credentials or user interaction, exploitation can be performed at scale against any site running an affected version.

WPScan published a vulnerability report detailing the issue at the referenced advisory URL. The EPSS score currently stands at 0.9335 with a recorded peak of 0.9358, indicating a high likelihood of exploitation attempts.