CVE-2024-0608: Wedevs WP ERP SQL Injection Vulnerability

CVE-2024-0608 Overview

CVE-2024-0608 is a union-based SQL injection vulnerability in the WP ERP plugin for WordPress, developed by wedevs. The plugin provides HR, CRM, and accounting functionality including recruitment and job listings integrated with WooCommerce. The flaw exists in all versions up to and including 1.13.1 and stems from insufficient escaping of the email parameter combined with inadequate SQL query preparation. Authenticated attackers with subscriber-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials and personally identifiable information stored by the ERP system.

Critical Impact
Authenticated subscribers can exfiltrate arbitrary database contents through union-based SQL injection, exposing user credentials, HR records, and CRM data.

Affected Products

WP ERP plugin for WordPress by wedevs
All versions up to and including 1.13.1
WordPress installations using the free distribution of WP ERP

Discovery Timeline

2024-03-29 - CVE-2024-0608 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0608

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89] and affects the AJAX handler defined in includes/Admin/Ajax.php at line 471 of the WP ERP plugin. The handler receives an email parameter from HTTP requests and incorporates the value directly into a database query without proper sanitization or parameterized statements.

Because the query construction lacks the $wpdb->prepare() safeguards expected in WordPress database access, an attacker-controlled email value can terminate the intended query context and append a UNION SELECT statement. The union-based technique lets the attacker align columns with the original result set and return arbitrary data from any table accessible to the WordPress database user.

Exploitation requires authentication at the subscriber level, which is the lowest privileged role in WordPress and is often obtainable through open registration. Impact is limited to confidentiality; the vulnerability does not directly permit modification or destruction of data.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The affected code path passes the email request parameter into a query string without escaping single quotes, comment sequences, or SQL keywords, and without binding parameters through prepared statements.

Attack Vector

The attack is delivered over the network through an authenticated AJAX request to the vulnerable endpoint. The attacker crafts an email parameter containing a payload that closes the intended string literal and appends a UNION SELECT clause targeting sensitive tables such as wp_users or ERP-specific tables. Refer to the Wordfence Vulnerability Analysis and the WordPress Ajax File Reference for the vulnerable code location.

Detection Methods for CVE-2024-0608

Indicators of Compromise

HTTP POST requests to WordPress admin-ajax.php containing an email parameter with SQL metacharacters such as ', UNION, SELECT, --, or /*
Authenticated requests from low-privilege subscriber accounts targeting WP ERP AJAX actions
Unexpected database errors or long-running queries in MySQL slow query logs referencing the WP ERP tables
Newly registered subscriber accounts that immediately issue AJAX requests to WP ERP endpoints

Detection Strategies

Inspect web server access logs for email parameter values containing URL-encoded SQL syntax such as %27%20UNION%20SELECT
Enable WordPress debug logging and MySQL general query logging to capture malformed queries generated by injected payloads
Deploy a web application firewall rule set that flags UNION, SLEEP, or INFORMATION_SCHEMA tokens in POST bodies to admin-ajax.php

Monitoring Recommendations

Alert on subscriber-role sessions accessing administrative AJAX actions outside their expected scope
Correlate spikes in WP ERP AJAX traffic with anomalous outbound data transfer from the web server
Track changes to WP ERP plugin files and version metadata to confirm patch status across all WordPress instances

How to Mitigate CVE-2024-0608

Immediate Actions Required

Update the WP ERP plugin to a version later than 1.13.1 that contains the fix from WordPress Changeset #3071807
Audit WordPress user accounts and remove untrusted subscriber-level accounts pending investigation
Rotate credentials for any accounts stored in the WordPress or WP ERP database if exploitation is suspected

Patch Information

The vendor addressed the vulnerability in the WP ERP source tree through WordPress Changeset #3071807. Administrators should upgrade through the WordPress plugin manager and verify the installed version reports a release higher than 1.13.1.

Workarounds

Disable open user registration to prevent unauthenticated actors from obtaining subscriber accounts
Restrict access to the affected AJAX endpoint using a web application firewall rule targeting requests with SQL keywords in the email parameter
Deactivate the WP ERP plugin until the patched version can be deployed if immediate updating is not feasible
Apply least-privilege database credentials so the WordPress database user cannot read tables outside the WordPress schema

bash

# Example WP-CLI command to update the plugin to the patched version
wp plugin update erp
wp plugin get erp --field=version