CVE-2024-56247
Published: 02 January 2025
Summary
CVE-2024-56247 is a high-severity SQL Injection (CWE-89) vulnerability in Afthemes Wp Post Author. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-56247 is an SQL Injection vulnerability (CWE-89) in the WP Post Author plugin for WordPress, developed by AF themes. The flaw stems from improper neutralization of special elements used in an SQL command within the wp-post-author component. It affects all versions of the plugin up to and including 3.8.2. The vulnerability has a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating high severity due to its network accessibility, low complexity, and potential for significant confidentiality impact across scope.
Exploitation requires high privileges (PR:H), such as those held by an authenticated administrator, and can be performed remotely over the network with low attack complexity and no user interaction. A successful attack allows the adversary to extract sensitive data from the database (high confidentiality impact), with a changed scope enabling broader effects, though integrity impact is none and availability impact is low.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-post-author/vulnerability/wordpress-wp-post-author-plugin-3-8-2-sql-injection-vulnerability?_s_id=cve provides details on the vulnerability, including recommendations for mitigation through updating the WP Post Author plugin to a version beyond 3.8.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53045
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows SQL Injection.This issue affects WP Post Author: from n/a through <= 3.8.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a publicly accessible WordPress plugin directly enables remote exploitation of a web application (T1190) for data extraction from the backend database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SQL injection vulnerability by requiring timely identification, reporting, and patching of the flaw in the WP Post Author plugin up to version 3.8.2.
Prevents SQL injection by enforcing validation and neutralization of special elements in information inputs used in SQL commands within the vulnerable wp-post-author component.
Detects the SQL injection vulnerability in the WP Post Author plugin through regular vulnerability scanning, enabling proactive remediation before exploitation.