CVE-2024-0956: Wedevs WP ERP SQL Injection Vulnerability

CVE-2024-0956 Overview

CVE-2024-0956 affects the WP ERP plugin for WordPress, a human resources, customer relationship management (CRM), and accounting solution. The vulnerability is a time-based SQL injection flaw in the erp/v1/accounting/v1/vendors/1/products/ REST route. It stems from insufficient escaping of the id parameter and inadequate preparation of the underlying SQL query. Authenticated attackers holding admin or accounting manager privileges can append additional SQL statements to existing queries. This allows extraction of sensitive data from the WordPress database. All versions of WP ERP up to and including 1.13.0 are affected.

Critical Impact
Authenticated attackers with elevated privileges can extract sensitive database contents through time-based SQL injection against the vendor products REST endpoint.

Affected Products

WP ERP plugin for WordPress (wedevs/wp_erp)
All versions up to and including 1.13.0
WordPress sites using the free WP ERP distribution

Discovery Timeline

2024-03-29 - CVE-2024-0956 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0956

Vulnerability Analysis

The flaw is classified as SQL Injection under [CWE-89]. The vulnerable code path lives in the accounting module products handler at modules/accounting/includes/functions/products.php. When the REST route erp/v1/accounting/v1/vendors/{id}/products/ is invoked, the id parameter reaches the SQL query without proper sanitization or parameterized binding. Attackers can append arbitrary SQL fragments that execute in the context of the original query. The exploit uses time-based techniques such as SLEEP() or conditional delays to infer query results. Because the response does not directly return injected data, the attacker measures response latency to reconstruct database contents byte by byte.

Root Cause

The root cause is missing use of $wpdb->prepare() with placeholder binding for the id parameter in the vendor products query. User-supplied input is concatenated directly into the SQL string, breaking the query grammar boundary. Reference the vulnerable code at the WordPress Plugin Code Review.

Attack Vector

Exploitation requires network access to the WordPress REST API and authenticated credentials with admin or accounting manager role. The attacker sends a crafted HTTP request to the vulnerable endpoint with a malicious id value containing a time-delay payload. Successful exploitation enables extraction of WordPress user hashes, session tokens, API keys, and any other sensitive data stored in the database. The fix landed in WordPress Plugin Changeset 3064874.

// Example exploitation code (sanitized)
// No verified public proof-of-concept is available.
// See the Wordfence advisory linked in references for technical details.

Detection Methods for CVE-2024-0956

Indicators of Compromise

Requests to /wp-json/erp/v1/accounting/v1/vendors/*/products/ containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the id parameter
Unusually long HTTP response times from the WP ERP accounting REST endpoints
Repeated authenticated requests from a single session iterating over character positions or ASCII ranges
Web server access logs showing URL-encoded SQL syntax in vendor products route parameters

Detection Strategies

Deploy a web application firewall (WAF) rule inspecting REST API requests to erp/v1/accounting/v1/vendors/*/products/ for non-numeric id values
Alert on any REST API request whose server processing time exceeds a defined threshold, indicating potential time-based injection
Correlate WordPress audit logs for authenticated admin or accounting manager sessions generating anomalous REST API volumes

Monitoring Recommendations

Enable WordPress user activity logging to track privileged account behavior on accounting endpoints
Forward web server and PHP error logs to a centralized analytics platform for query analysis
Monitor MySQL slow query logs for statements originating from the erp_acct_products table with unexpected WHERE clause structures

How to Mitigate CVE-2024-0956

Immediate Actions Required

Upgrade the WP ERP plugin to a version above 1.13.0 where the parameter is properly prepared
Audit WordPress user accounts and revoke admin or accounting manager privileges that are no longer required
Rotate database credentials, WordPress salts, and any secrets that may have been exposed on affected sites
Review web server access logs for suspicious REST API traffic targeting the vulnerable route

Patch Information

The vendor addressed the vulnerability in WordPress Plugin Changeset 3064874 by adding proper SQL query preparation. Detailed analysis is available in the Wordfence Vulnerability Analysis.

Workarounds

Restrict access to /wp-json/erp/ REST routes at the web server or WAF layer to trusted IP ranges
Temporarily deactivate the WP ERP accounting module if patching is not immediately possible
Enforce multi-factor authentication for all administrative and accounting manager accounts to reduce credential abuse risk

bash

# Configuration example: nginx rule to block non-numeric id values
location ~ ^/wp-json/erp/v1/accounting/v1/vendors/[^0-9]+/products/ {
    return 403;
}