CVE-2024-0913: Wedevs WP ERP SQL Injection Vulnerability

CVE-2024-0913 Overview

CVE-2024-0913 is a time-based SQL Injection vulnerability [CWE-89] in the WP ERP plugin for WordPress. The flaw affects the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to and including 1.13.0. The plugin fails to properly escape the user-supplied status and customer_id parameters and does not sufficiently prepare the underlying SQL statement. Authenticated attackers with accounting manager or administrator privileges can append arbitrary SQL to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including credentials, session tokens, and business records stored by the HR, CRM, and accounting modules.

Critical Impact
Authenticated attackers with elevated roles can exfiltrate arbitrary database contents from affected WordPress sites through blind, time-based SQL injection.

Affected Products

weDevs WP ERP plugin for WordPress
All versions up to and including 1.13.0
Deployments using the accounting module and sales transactions REST endpoint

Discovery Timeline

2024-03-29 - CVE-2024-0913 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0913

Vulnerability Analysis

The vulnerability resides in the accounting transactions handler at modules/accounting/includes/functions/transactions.php. The REST route erp/v1/accounting/v1/transactions/sales accepts status and customer_id query parameters and concatenates them directly into a SQL statement executed against the WordPress database. Because the plugin does not use $wpdb->prepare() correctly and omits escaping on these inputs, the query becomes a sink for attacker-controlled SQL fragments.

An authenticated user with the accounting manager or administrator capability can send crafted values that alter the query structure. Since the endpoint returns limited data, exploitation typically takes the form of time-based blind SQL injection using functions such as SLEEP() or conditional BENCHMARK() calls. The attacker infers database contents from response latency, one byte at a time.

Root Cause

The root cause is improper neutralization of special elements in an SQL command. The status and customer_id parameters flow from the REST request into a raw SQL string without parameterized placeholders. See the WordPress Plugin Code Review and the WordPress Plugin Changeset for the vulnerable code and its patch.

Attack Vector

Exploitation requires network access to the WordPress REST API and a valid session for an account holding accounting manager or higher privileges. The attacker issues authenticated HTTP requests to the sales transactions endpoint, embedding a time-based payload in the status or customer_id parameter. Response delays disclose Boolean conditions, enabling full database enumeration over repeated requests. Refer to the Wordfence Vulnerability Report for exploitation context.

No public proof-of-concept or in-the-wild exploitation has been documented.

Detection Methods for CVE-2024-0913

Indicators of Compromise

Requests to /wp-json/erp/v1/accounting/v1/transactions/sales containing SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or encoded variants in the status or customer_id parameters.
Unusually long response times from the sales transactions endpoint, consistent with time-based blind injection.
REST API activity from accounting manager or administrator accounts outside of normal working hours or from unexpected IP addresses.

Detection Strategies

Enable WordPress REST API request logging and inspect query parameters submitted to the WP ERP accounting endpoints.
Deploy a web application firewall rule that inspects status and customer_id values for SQL metacharacters and time-delay functions.
Correlate authenticated REST calls with slow-query logs on the MySQL or MariaDB backend to identify injected SLEEP execution.

Monitoring Recommendations

Alert on wp_users and wp_usermeta table reads originating from PHP-FPM workers processing REST requests.
Track failed and successful logins for accounts with erp_ac_manager or administrator capabilities and flag lateral misuse.
Baseline endpoint response times for /wp-json/erp/* and alert on deviations exceeding several seconds.

How to Mitigate CVE-2024-0913

Immediate Actions Required

Upgrade the WP ERP plugin to a version later than 1.13.0 that includes the fix delivered in changeset 3064874.
Audit accounting manager and administrator accounts, remove unused privileged users, and rotate credentials for any that may have been compromised.
Review database and application logs for anomalous queries against the accounting tables since the plugin was installed.

Patch Information

The vendor addressed the issue in the WP ERP repository via changeset 3064874, which introduces proper preparation and escaping for the status and customer_id parameters in the sales transactions query. Sites running 1.13.0 or earlier must update through the WordPress plugin manager or by replacing the plugin files with a patched release.

Workarounds

Restrict access to /wp-json/erp/v1/accounting/v1/transactions/sales at the reverse proxy or WAF layer to trusted administrative IP ranges until patching is complete.
Temporarily reduce the number of users assigned accounting manager or administrator roles to shrink the pool of accounts capable of exploiting the endpoint.
Enforce multi-factor authentication for privileged WordPress accounts to raise the cost of credential-based access to the vulnerable endpoint.

bash

# Example: block the vulnerable endpoint at nginx until patched
location ~ ^/wp-json/erp/v1/accounting/v1/transactions/sales {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
}