CVE-2024-13184: WP Extended Plugin SQL Injection Flaw

CVE-2024-13184 Overview

CVE-2024-13184 is a time-based SQL injection vulnerability in the Ultimate WordPress Toolkit – WP Extended plugin for WordPress. The flaw affects all versions up to and including 3.0.12 and resides in the Login Attempts module. Unauthenticated attackers can append additional SQL queries to existing database calls because of insufficient escaping on a user-supplied parameter and missing query preparation. Successful exploitation allows extraction of sensitive information from the WordPress database.

Critical Impact

Unauthenticated remote attackers can exfiltrate database contents — including user credentials, session tokens, and configuration data — through time-based SQL injection against any WordPress site running WP Extended 3.0.12 or earlier.

Affected Products

• Ultimate WordPress Toolkit – WP Extended plugin (all versions ≤ 3.0.12)
• Vulnerable module: wpext_limit_login_attempts
• Vulnerable file: includes/modules/core_extensions/wpext_limit_login_attempts/wpext_limit_login_attempts.php

Discovery Timeline

• 2025-01-18 - CVE-2024-13184 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-13184

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. It exists in the Login Attempts module of the WP Extended plugin, which tracks failed authentication attempts against WordPress sites. The module accepts user-supplied input and concatenates it directly into a SQL query without sufficient escaping or use of WordPress's $wpdb->prepare() parameterization API.

Because the injection point is reachable without authentication, any anonymous visitor can issue crafted HTTP requests against a vulnerable site. Attackers use time-based blind injection techniques such as SLEEP() payloads to infer query results one bit at a time, eventually reconstructing arbitrary table contents. The EPSS score of 0.945% places this issue in the 76th percentile for exploitation likelihood.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The plaintiff parameter passed to the Login Attempts module is interpolated into a SQL string without escaping or prepared statement binding. WordPress provides $wpdb->prepare() specifically to prevent this class of bug, but the affected code path bypasses it. The fix is visible in WordPress changeset 3220003.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single HTTP request to the WordPress endpoint that invokes the Login Attempts module. The malicious parameter contains SQL syntax that breaks out of the intended query context and appends attacker-controlled statements. Time-based blind injection uses query response delay as an oracle to leak data byte-by-byte from the wp_users, wp_usermeta, and wp_options tables.

No public proof-of-concept exploit is currently listed in Exploit-DB, but the Wordfence advisory documents the affected parameter and request structure. See the Wordfence Vulnerability Report and the WordPress Plugin Code for technical details.

Detection Methods for CVE-2024-13184

Indicators of Compromise

• HTTP requests to WP Extended Login Attempts endpoints containing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, or encoded variants
• Unusually long response times from wp-admin/admin-ajax.php or front-end login pages on sites running WP Extended
• Database query logs showing concatenated or malformed SQL involving the wpext_limit_login_attempts table
• Repeated requests from a single IP address with incrementally varying payloads consistent with blind injection enumeration

Detection Strategies

• Inspect web server access logs for query strings or POST bodies containing SQL metacharacters targeting WP Extended module parameters
• Enable WordPress query logging or use a database activity monitor to identify unprepared statements originating from the plugin
• Deploy a Web Application Firewall (WAF) rule that blocks SQL syntax in parameters destined for the WP Extended login attempts handler
• Correlate slow database response metrics with HTTP request patterns to identify time-based probing

Monitoring Recommendations

• Alert on outbound data transfers from web application servers that exceed normal baselines, indicating possible exfiltration
• Monitor for new or unexpected administrative accounts created in wp_users following suspicious request patterns
• Track plugin version inventory across WordPress estates and flag instances of WP Extended at 3.0.12 or below

How to Mitigate CVE-2024-13184

Immediate Actions Required

• Update the Ultimate WordPress Toolkit – WP Extended plugin to a version newer than 3.0.12 that includes the fix from changeset 3220003
• Audit wp_users and wp_usermeta for unauthorized accounts or modified privileges and rotate all administrator passwords
• Invalidate active WordPress sessions and rotate any secrets stored in wp_options, including API keys and authentication salts
• Review web server and database logs for the prior 90 days for indicators of exploitation

Patch Information

The plugin maintainer addressed the vulnerability in WordPress Changeset 3220003. Administrators should upgrade through the WordPress plugin manager or download the fixed release from the WordPress Plugin Developer page. Verify the installed version after upgrade to confirm remediation.

Workarounds

• Deactivate and remove the WP Extended plugin until the patched version can be deployed
• Disable the Login Attempts module within WP Extended if granular module control is available in your installed version
• Apply WAF signatures that block SQL syntax in HTTP parameters targeting the vulnerable endpoint
• Restrict access to WordPress administrative and AJAX endpoints by IP allowlist where operationally feasible

# Example: WP-CLI command to identify and update the vulnerable plugin
wp plugin list --name=wpextended --fields=name,status,version
wp plugin update wpextended
wp plugin get wpextended --field=version