CVE-2024-12613: Passwords Manager Plugin SQLi Vulnerability

CVE-2024-12613 Overview

CVE-2024-12613 is a SQL Injection vulnerability in the Passwords Manager plugin for WordPress, developed by Hirewebxperts. The flaw affects all versions up to and including 1.4.8. The plugin fails to properly escape user-supplied input and lacks sufficient query preparation when handling the $wpdb->prefix value across several AJAX functions. Unauthenticated attackers can append additional SQL queries to existing statements and extract sensitive data from the WordPress database. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents, including stored passwords managed by the plugin, by injecting SQL payloads via vulnerable AJAX endpoints.

Affected Products

• Hirewebxperts Passwords Manager plugin for WordPress
• All versions up to and including 1.4.8
• WordPress installations using the vulnerable plugin component pms-passwords-ajax-action.php

Discovery Timeline

• 2025-01-16 - CVE-2024-12613 published to NVD
• 2025-01-17 - Last updated in NVD database

Technical Details for CVE-2024-12613

Vulnerability Analysis

The Passwords Manager plugin exposes multiple AJAX handlers that build SQL statements by concatenating the $wpdb->prefix value directly into queries. The plugin treats this value as trusted input and does not apply $wpdb->prepare() or sanitization routines before executing the constructed SQL. Attackers can manipulate the request to inject SQL fragments that extend the original query. Because the vulnerable AJAX endpoints do not require authentication, any remote attacker who can reach the WordPress site can trigger the injection. Successful exploitation enables extraction of sensitive content stored in the database, including credentials managed by the plugin itself.

Root Cause

The root cause is improper neutralization of input used in SQL queries within include/pms-passwords-ajax-action.php. The plugin relies on string interpolation of the $wpdb->prefix value into raw SQL rather than parameterized statements via $wpdb->prepare(). Insufficient escaping combined with the absence of prepared statements allows attacker-controlled data to alter query structure.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP POST requests to the WordPress admin-ajax.php endpoint targeting the vulnerable AJAX actions registered by Passwords Manager. By injecting SQL clauses such as UNION SELECT payloads, the attacker can read arbitrary tables. Refer to the Wordfence Vulnerability Report and the WordPress Change Log Entry for the patched code details.

No public proof-of-concept code is available. The vulnerability manifests in the AJAX action handlers where SQL is constructed without prepared statements; see the upstream changeset for the corrective changes.

Detection Methods for CVE-2024-12613

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing Passwords Manager AJAX action names with SQL meta-characters such as UNION, SELECT, --, or ' OR ' in parameter values.
• Unexpected outbound responses with large payloads from admin-ajax.php correlated with anonymous source IPs.
• WordPress error log entries showing MySQL syntax errors originating from the pms-passwords-ajax-action.php code path.

Detection Strategies

• Inspect web server access logs for unauthenticated requests to admin-ajax.php invoking Passwords Manager actions with suspicious query strings.
• Deploy Web Application Firewall (WAF) rules that match common SQL injection patterns targeting WordPress AJAX endpoints.
• Enable MySQL general query logging temporarily on suspected sites to identify malformed or injected queries referencing plugin tables.

Monitoring Recommendations

• Alert on spikes in admin-ajax.php traffic from unauthenticated sessions, especially those referencing the passwords-manager action prefix.
• Monitor for new or unusual database read patterns against tables created by the Passwords Manager plugin.
• Track plugin version inventories across WordPress sites to identify installations still running 1.4.8 or earlier.

How to Mitigate CVE-2024-12613

Immediate Actions Required

• Update the Passwords Manager plugin to the version released after changeset 3221505 on plugins.trac.wordpress.org.
• If a patched version is not yet available, deactivate and remove the Passwords Manager plugin from all WordPress installations.
• Rotate any credentials stored within the plugin, as database contents may have been exposed.
• Review WordPress and database logs for evidence of SQL injection attempts prior to remediation.

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository. The corrective code change is published in the WordPress plugin changeset 3221505, which updates the affected AJAX handlers in pms-passwords-ajax-action.php to properly prepare SQL statements.

Workarounds

• Restrict access to /wp-admin/admin-ajax.php via WAF rules that block anonymous SQL injection patterns targeting Passwords Manager actions.
• Disable the plugin until the patched release can be deployed and validated in a staging environment.
• Apply principle of least privilege to the MySQL user configured in wp-config.php to limit the scope of data accessible via injected queries.

# Example WAF rule snippet (ModSecurity) to block SQLi patterns on WordPress AJAX
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012613,msg:'Possible SQLi targeting Passwords Manager AJAX'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|--\s|';|\bor\b\s+1=1)" "t:none,t:urlDecodeUni"