CVE-2024-1206: WP Recipe Maker SQL Injection Vulnerability

CVE-2024-1206 Overview

CVE-2024-1206 is a SQL injection vulnerability affecting the WP Recipe Maker plugin for WordPress. The flaw exists in all versions up to and including 9.1.2. It stems from insufficient escaping of the user-supplied recipes parameter and a lack of proper preparation on the underlying SQL query [CWE-89]. Authenticated attackers with subscriber-level access or above can append additional SQL statements to existing queries. This allows extraction of sensitive information directly from the WordPress database.

Critical Impact
Authenticated attackers with minimal privileges can inject arbitrary SQL and exfiltrate database contents, including user credentials and site secrets.

Affected Products

Bootstrapped WP Recipe Maker plugin for WordPress, versions up to and including 9.1.2
WordPress sites permitting subscriber-level registration with the vulnerable plugin installed
Any deployment relying on the affected import handlers under includes/admin/import/

Discovery Timeline

2024-02-29 - CVE-2024-1206 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1206

Vulnerability Analysis

The vulnerability resides in the WP Recipe Maker import subsystem, specifically in files under includes/admin/import/ such as class-wprm-import-manager.php, class-wprm-import-mealplannerpro.php, class-wprm-import-recipecard.php, class-wprm-import-wpzoom.php, class-wprm-import-wpzoomcpt.php, and class-wprm-import-yummly.php. The plugin accepts the recipes parameter from an authenticated HTTP request and concatenates it into SQL statements without adequate sanitization or use of $wpdb->prepare() placeholders. Because WordPress subscribers reach these import handlers, the attack surface expands beyond administrators to any low-privileged authenticated user.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The plugin trusts the recipes request parameter and inserts it into database queries without parameterized binding or proper escaping. The fix committed in changeset 3032702 on WordPress plugin trac introduces prepared statements and stronger input handling across the affected import classes.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated session at subscriber level or higher. The attacker submits a crafted recipes parameter to a plugin import endpoint. The injected fragment closes the intended SQL context and appends attacker-controlled clauses, typically a UNION SELECT used to enumerate tables and read rows from wp_users, wp_usermeta, or wp_options. See the Wordfence Vulnerability Analysis for additional technical details.

No public proof-of-concept exploit is currently available. The vulnerability mechanism is a standard authenticated union-based SQL injection through an unsanitized request parameter passed to backend queries.

Detection Methods for CVE-2024-1206

Indicators of Compromise

Requests to WP Recipe Maker admin-ajax or import endpoints containing SQL metacharacters in the recipes parameter, such as UNION, SELECT, --, /*, SLEEP(, or information_schema.
Unexpected subscriber-level accounts issuing requests to admin-ajax.php actions belonging to wp-recipe-maker.
Web server logs showing abnormally long or URL-encoded recipes values from low-privileged authenticated sessions.
Database error responses returned to subscriber accounts referencing plugin import handlers.

Detection Strategies

Enable WordPress and web application firewall (WAF) logging for authenticated requests to plugin AJAX and REST endpoints, and alert on SQL syntax in recipes values.
Correlate failed and successful queries executed by the WordPress database user with plugin import handler invocations.
Baseline normal usage of WP Recipe Maker import actions per user role, then alert on subscriber-role activity against these endpoints.

Monitoring Recommendations

Forward WordPress access logs and MySQL general or slow query logs to a centralized SIEM for correlation.
Monitor for creation of new subscriber accounts followed shortly by requests to wp-recipe-maker endpoints.
Track outbound data volume from the WordPress host to detect bulk exfiltration following successful injection.

How to Mitigate CVE-2024-1206

Immediate Actions Required

Update WP Recipe Maker to a version later than 9.1.2 that includes changeset 3032702.
Audit WordPress user accounts and remove or disable unused subscriber-level accounts.
Disable open user registration (Anyone can register) unless required for site operation.
Review database logs for signs of prior injection attempts against recipes parameters.

Patch Information

The vendor addressed the issue in changeset 3032702 on WordPress plugin trac, which rewrites the affected import handlers to use prepared statements. Refer to the WordPress Import Manager Changeset, the Meal Planner Pro Import fix, and the Recipe Card Import fix for the specific code changes.

Workarounds

Deploy a WAF rule blocking SQL keywords and metacharacters in the recipes request parameter for wp-recipe-maker endpoints.
Restrict access to /wp-admin/admin-ajax.php actions related to WP Recipe Maker to administrator roles via a mu-plugin capability check.
Temporarily deactivate the WP Recipe Maker plugin until the update can be applied on production sites.

bash

# Example WAF rule pattern (ModSecurity-style) to block SQL metacharacters
# in the 'recipes' parameter for WP Recipe Maker endpoints
SecRule ARGS:recipes "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|sleep\s*\(|--\s|/\*)" \
    "id:1002024,phase:2,deny,status:403,log,\
    msg:'CVE-2024-1206 WP Recipe Maker SQLi attempt in recipes parameter'"