CVE-2024-1173 Overview
CVE-2024-1173 is a time-based SQL injection vulnerability affecting the WP ERP plugin for WordPress. The flaw exists in all versions up to and including 1.13.1. Attackers with accounting manager or admin privileges can inject arbitrary SQL through the id parameter due to insufficient input escaping and improper query preparation. Successful exploitation allows extraction of sensitive data from the WordPress database.
The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). The WP ERP plugin provides HR, CRM, and accounting features to WordPress sites, making database contents particularly sensitive.
Critical Impact
Authenticated attackers with elevated privileges can extract sensitive database contents, including credentials, customer data, and financial records stored by the WP ERP plugin.
Affected Products
- WP ERP plugin for WordPress (free edition) — all versions up to and including 1.13.1
- WordPress sites running the wedevs wp_erp accounting module
- Deployments exposing accounting manager or admin roles to untrusted users
Discovery Timeline
- 2024-05-02 - CVE-2024-1173 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1173
Vulnerability Analysis
The vulnerability resides in the accounting module of the WP ERP plugin, specifically in modules/accounting/includes/functions/people.php. The id parameter is concatenated directly into an SQL statement without proper escaping or use of prepared statements. This lets an authenticated attacker append additional SQL clauses to the existing query.
The injection is time-based, meaning attackers use conditional delays such as SLEEP() to infer database contents one bit at a time. Although exploitation requires accounting manager or admin authentication, these roles are often granted to internal staff who should not have direct database read access. The attack is fully remote over the network via authenticated HTTP requests.
Root Cause
The root cause is a failure to sanitize user-supplied input before including it in a raw SQL query. WordPress provides the $wpdb->prepare() API to safely parameterize queries, but the affected function bypasses this protection. The id value flows from an HTTP request into the SQL statement without type casting or escaping.
Attack Vector
An authenticated attacker holding an accounting manager or admin role submits a crafted id parameter to a vulnerable endpoint in the accounting module. By appending payloads that conditionally trigger SLEEP() or similar time-delay functions, the attacker performs boolean-style inference against the database. Repeated requests reconstruct data such as WordPress user hashes stored in wp_users, session tokens, and accounting records.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Advisory and the WordPress ERP Function Code for the vulnerable code location.
Detection Methods for CVE-2024-1173
Indicators of Compromise
- HTTP requests to WP ERP accounting endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the id parameter.
- Web server access logs showing repeated requests with incrementally varying id values from a single authenticated session.
- Anomalous response latency patterns on accounting module endpoints, consistent with time-based blind SQL injection.
- Database query logs containing malformed statements originating from people.php in the WP ERP accounting module.
Detection Strategies
- Deploy WordPress-aware web application firewall (WAF) rules that inspect authenticated requests to wp-admin endpoints handled by the WP ERP plugin.
- Enable MySQL general or slow query logging to capture injected SQL patterns and long-running queries triggered by time-based payloads.
- Correlate authenticated user activity with unusual request volume against accounting module URLs.
Monitoring Recommendations
- Alert on any request to WP ERP accounting endpoints where the id parameter contains non-numeric characters.
- Monitor for privilege changes granting the accounting manager role to unexpected accounts.
- Track outbound data volumes from the WordPress host that could indicate bulk exfiltration following successful injection.
How to Mitigate CVE-2024-1173
Immediate Actions Required
- Update the WP ERP plugin to a version later than 1.13.1 that contains the fix committed in changeset 3071807.
- Audit all WordPress accounts holding accounting manager or admin roles and remove unnecessary privileges.
- Rotate WordPress secrets, database credentials, and any API keys stored in the affected site if exploitation is suspected.
Patch Information
The vendor addressed the issue by properly preparing the affected SQL query. Review the fix in the WordPress ERP Changeset Update and the pre-patch code in the WordPress ERP Function Code. Site administrators should update through the WordPress plugin manager or by replacing the plugin directory with the patched release.
Workarounds
- Restrict access to the WordPress admin area using IP allowlisting or a reverse proxy until the plugin is patched.
- Temporarily deactivate the WP ERP plugin on sites that cannot be updated immediately.
- Deploy WAF rules that block requests with SQL metacharacters in the id parameter targeting WP ERP accounting endpoints.
- Enforce multi-factor authentication for all accounts with accounting manager or admin roles to reduce risk of credential-based abuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
