CVE-2024-0952 Overview
The WP ERP plugin for WordPress contains a time-based SQL injection vulnerability affecting all versions up to and including 1.12.9. The flaw resides in the id parameter handling within the accounting module, where user-supplied input receives insufficient escaping and the underlying SQL query lacks proper preparation. Authenticated attackers holding accounting manager, administrator, or higher privileges can append arbitrary SQL statements to existing queries. Successful exploitation enables extraction of sensitive database contents, including credentials, personal information, and financial records managed by the customer relationship management (CRM) and human resources (HR) modules.
Critical Impact
Authenticated attackers with accounting manager or administrator privileges can execute arbitrary SQL queries against the WordPress database, exposing sensitive HR, CRM, and accounting records.
Affected Products
- WP ERP plugin for WordPress versions 1.12.9 and earlier
- WP ERP Complete HR solution with recruitment and job listings module
- WP ERP WooCommerce CRM and Accounting integration modules
Discovery Timeline
- 2024-04-09 - CVE-2024-0952 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0952
Vulnerability Analysis
The vulnerability is a time-based blind SQL injection classified under [CWE-89]. It affects the accounting module's people.php file, specifically the functions handling person record lookups by identifier. The id parameter reaches an SQL query without adequate sanitization or use of prepared statements. Attackers craft payloads containing SQL time-delay functions such as SLEEP() or BENCHMARK() and infer query results from response latency. Because the vulnerable endpoint requires authenticated access with accounting manager or administrator privileges, exploitation depends on either legitimate credential access or prior privilege compromise.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command. The id parameter is concatenated into the SQL statement without being cast to an integer or passed through the WordPress $wpdb->prepare() API. Fixed strings in the query are not sufficient to prevent injection when user input is directly interpolated.
Attack Vector
The attack requires network access to the WordPress admin interface and valid authentication as an accounting manager or higher role. An attacker submits a manipulated id parameter to the vulnerable accounting endpoint. The injected SQL executes within the database context of the WordPress site. Repeated requests using conditional time delays allow the attacker to enumerate table names, column names, and row values one bit at a time. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2024-0952
Indicators of Compromise
- Web server access logs containing id parameter values with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or encoded variants targeting accounting module endpoints.
- Unusually long response times from /wp-admin/ requests routed through the WP ERP accounting module.
- Repeated authenticated requests from a single user session iterating through numeric or boolean payload patterns against the id parameter.
Detection Strategies
- Deploy a web application firewall (WAF) rule to inspect requests to WP ERP accounting endpoints for SQL metacharacters and time-delay function names in the id parameter.
- Correlate authenticated administrative sessions with anomalous database query duration metrics from MySQL slow query logs.
- Audit WordPress user role changes and monitor accounts elevated to accounting manager or administrator roles that subsequently interact with accounting endpoints.
Monitoring Recommendations
- Enable MySQL general query logging or slow query logging on WordPress database hosts to capture injected SLEEP() calls.
- Forward WordPress and web server logs to a centralized log platform and alert on outlier request durations for authenticated admin sessions.
- Track plugin version inventory across WordPress deployments to identify hosts still running WP ERP 1.12.9 or earlier.
How to Mitigate CVE-2024-0952
Immediate Actions Required
- Upgrade the WP ERP plugin to version 1.13.0 or later on all WordPress sites where it is installed.
- Review WordPress user accounts and remove or downgrade unnecessary accounting manager and administrator role assignments.
- Rotate credentials for any account with accounting manager or higher privileges if compromise is suspected.
Patch Information
The vendor released version 1.13.0 of WP ERP with corrected query construction in the accounting people functions. The patch is documented in the WordPress Plugin Changeset, which shows the addition of proper input handling on the id parameter before it enters the SQL query.
Workarounds
- If patching is not immediately possible, restrict access to the WordPress admin interface to trusted IP addresses using web server or firewall rules.
- Temporarily suspend accounting manager role assignments and limit accounting module access to a single reviewed administrator account.
- Deploy a WAF signature that blocks SQL keywords and time-delay functions in the id parameter of WP ERP accounting requests.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
