CVE-2024-1317 Overview
CVE-2024-1317 is a SQL injection vulnerability in the Feedzy RSS Aggregator WordPress plugin by Themeisle. The flaw exists in all versions up to and including 4.4.2, affecting the search_key parameter. Insufficient escaping of user input and inadequate SQL statement preparation allow authenticated attackers with contributor-level access or higher to append additional SQL queries to existing statements. Successful exploitation enables extraction of sensitive data from the WordPress database, including credentials, user metadata, and site secrets. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated contributors can extract arbitrary data from the WordPress database, including password hashes, session tokens, and site configuration secrets stored in wp_options.
Affected Products
- Themeisle RSS Aggregator by Feedzy for WordPress — all versions through 4.4.2
- Feedzy Feed to Post and Autoblogging module
- Feedzy News and YouTube Video Feeds Aggregator functionality
Discovery Timeline
- 2024-02-29 - CVE-2024-1317 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1317
Vulnerability Analysis
The vulnerability resides in the Feedzy plugin's administrative code path that processes the search_key request parameter. The plugin concatenates the attacker-supplied string directly into a SQL query without applying $wpdb->prepare() or equivalent parameterization. Because escaping routines are also insufficient, a contributor can inject SQL syntax that terminates the intended query and appends additional statements. This class of flaw is a canonical CWE-89 instance and enables UNION-based data extraction against the WordPress database tables.
Root Cause
The root cause is unsafe query construction in the plugin's admin handler located in includes/admin/feedzy-rss-feeds-admin.php. The search_key value flows from the HTTP request into a dynamically built SQL query without being passed through $wpdb->prepare(). The vendor's fix in changeset 3033749 introduced proper prepared statements and parameter binding.
Attack Vector
Exploitation requires an authenticated WordPress account with contributor privileges or higher. The attacker submits a crafted search_key parameter to the vulnerable admin endpoint. The injected payload commonly leverages UNION SELECT clauses to exfiltrate rows from wp_users and wp_usermeta. Because contributor accounts are frequently issued through open registration or self-service workflows on multi-author WordPress sites, the effective barrier to exploitation is low.
See the pre-patch vulnerable source at the WordPress Feedzy Import File and the Wordfence Vulnerability Report for further technical detail.
Detection Methods for CVE-2024-1317
Indicators of Compromise
- HTTP POST or GET requests to WordPress admin-ajax or Feedzy admin endpoints containing search_key values with SQL metacharacters such as ', UNION, SELECT, --, or /*.
- Unexpected reads against wp_users, wp_usermeta, or wp_options in MySQL general or slow query logs correlated with contributor session activity.
- New or modified WordPress administrator accounts created shortly after suspicious search_key requests from contributor sessions.
Detection Strategies
- Deploy a web application firewall rule that inspects the search_key parameter for SQL syntax tokens and blocks requests originating from non-administrative sessions.
- Enable MySQL query logging on WordPress database hosts and alert on UNION SELECT patterns against WordPress core tables.
- Correlate WordPress authentication logs with request patterns to identify contributor accounts issuing atypical admin-endpoint requests.
Monitoring Recommendations
- Inventory all WordPress sites running Feedzy and verify plugin versions against 4.4.3 or later using the WordPress REST API.
- Monitor the wp_users table for unexpected insertions and privilege changes on affected sites.
- Track outbound connections from PHP worker processes that could indicate post-exploitation data exfiltration.
How to Mitigate CVE-2024-1317
Immediate Actions Required
- Upgrade the Feedzy RSS Aggregator plugin to version 4.4.3 or later on every WordPress installation.
- Audit all WordPress user accounts and remove or downgrade unnecessary contributor-and-above roles.
- Rotate WordPress administrator passwords, API keys, and secrets stored in wp_options if exploitation is suspected.
- Review wp_users and wp_usermeta for unauthorized accounts created after February 2024.
Patch Information
Themeisle addressed the vulnerability in Feedzy version 4.4.3. The fix replaces unsafe string concatenation with $wpdb->prepare() calls in the affected admin handler. Review the vendor commit at WordPress Feedzy Changeset 3033749 for the authoritative patch. WordPress site administrators can install the update via the plugin dashboard or wp-cli.
Workarounds
- Temporarily deactivate the Feedzy plugin until the patched version is installed.
- Restrict contributor registration and require administrator approval for new author-level accounts.
- Apply a WAF virtual patch that blocks SQL metacharacters in the search_key parameter on Feedzy admin routes.
- Enforce least privilege by removing plugin management capabilities from non-administrative roles.
# Update Feedzy to the patched version using wp-cli
wp plugin update feedzy-rss-feeds --version=4.4.3
# Verify installed version across all sites
wp plugin get feedzy-rss-feeds --field=version
# List users with contributor role or higher for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
