CVE-2024-12157: WordPress Popup Plugin SQLi Vulnerability

CVE-2024-12157 Overview

CVE-2024-12157 is a SQL injection vulnerability in the Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin for WordPress. The flaw affects all versions up to and including 3.2.6. It exists in the upc_delete_db_record AJAX action, where the id parameter is not properly escaped and the SQL query lacks sufficient preparation. Unauthenticated attackers can append SQL queries to existing statements to extract sensitive data from the WordPress database. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive information, including user credentials and session data, from the WordPress database without authentication or user interaction.

Affected Products

Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin for WordPress
All versions up to and including 3.2.6
WordPress sites with the Ultimate Popup Creator plugin enabled

Discovery Timeline

2025-01-07 - CVE-2024-12157 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12157

Vulnerability Analysis

The vulnerability resides in the upc_delete_db_record AJAX action handler exposed by the plugin. The handler accepts an id parameter from the HTTP request and concatenates it directly into a SQL DELETE statement. Because the plugin does not call $wpdb->prepare() with parameterized placeholders and does not sanitize the input through functions such as absint() or esc_sql(), attacker-controlled data reaches the SQL parser unaltered.

WordPress exposes admin-ajax.php to unauthenticated users for any action registered with the wp_ajax_nopriv_ hook prefix. The vulnerable AJAX action is reachable without credentials, removing any access-control barrier for exploitation. Attackers can deliver UNION-based or time-based blind injection payloads through the id parameter.

Root Cause

The root cause is the combination of two coding defects: insufficient input escaping on the user-supplied id parameter and a raw SQL query construction that bypasses WordPress prepared statement APIs. The handler trusts client-supplied input that should have been cast to an integer or bound as a placeholder before query execution.

Attack Vector

Exploitation requires only a network-reachable WordPress installation running a vulnerable version of the plugin. An attacker sends a crafted POST or GET request to /wp-admin/admin-ajax.php with action=upc_delete_db_record and a malicious id value. Payloads typically use SQL UNION SELECT clauses to exfiltrate data from the wp_users and wp_usermeta tables, including password hashes and session tokens.

No authentication is required. No user interaction is required. The attack can be automated at scale against indexed WordPress sites.

The vulnerability manifests in the plugin's AJAX delete handler. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-12157

Indicators of Compromise

HTTP requests to /wp-admin/admin-ajax.php containing action=upc_delete_db_record with non-integer or SQL-keyword content in the id parameter
Web server access logs showing URL-encoded SQL syntax such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA against the AJAX endpoint
Unusual database error responses or extended response times correlated with requests to the vulnerable action
Outbound DNS or HTTP callbacks from the database host during or immediately after AJAX requests

Detection Strategies

Deploy web application firewall rules that inspect the id parameter of upc_delete_db_record requests for non-numeric values and SQL syntax tokens
Enable MySQL general query logging temporarily to identify malformed or anomalous DELETE statements originating from the plugin
Correlate WordPress access logs with database query patterns to identify time-based blind SQL injection attempts
Inventory installed plugins across managed WordPress sites and flag any instance of Ultimate Popup Creator at version 3.2.6 or earlier

Monitoring Recommendations

Continuously monitor admin-ajax.php traffic for spikes in requests to plugin-specific actions from single IP addresses
Alert on HTTP 500 responses from admin-ajax.php that may indicate failed injection attempts triggering database errors
Track new administrator accounts, password hash changes, and unexpected privilege escalations following suspicious AJAX traffic
Forward WordPress and web server logs to a centralized log analytics platform for retrospective hunting against historical exploitation attempts

How to Mitigate CVE-2024-12157

Immediate Actions Required

Update the Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin to a version newer than 3.2.6 as soon as a patched release is available
If no patched version is available, deactivate and remove the plugin from all WordPress installations
Review WordPress and database logs for evidence of prior exploitation against the upc_delete_db_record action
Rotate WordPress administrator passwords, API keys, and session salts if exploitation indicators are present

Patch Information

Review the official WordPress Plugin Information page for the latest available release. Confirm the changelog references a fix for the upc_delete_db_record AJAX SQL injection before deploying. Verify the installed version on each managed site after applying the update.

Workarounds

Block requests to /wp-admin/admin-ajax.php with action=upc_delete_db_record at the web application firewall or reverse proxy layer
Restrict access to admin-ajax.php by source IP where business requirements permit
Apply a WAF signature that rejects non-integer values in the id parameter of the vulnerable AJAX action
Deploy database-layer least-privilege controls so the WordPress database user cannot read sensitive tables beyond what the application requires

bash

# Example NGINX configuration to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "upc_delete_db_record") {
        return 403;
    }
}