CVE-2024-13344: WooCommerce Seat Reservation SQLi Flaw

CVE-2024-13344 Overview

CVE-2024-13344 is a SQL injection vulnerability in the Advance Seat Reservation Management for WooCommerce plugin for WordPress. The flaw resides in the handling of the profileId parameter and affects all versions up to and including 3.3. The plugin fails to escape user-supplied input and does not properly prepare the underlying SQL query [CWE-89]. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive information from the database.

Critical Impact

Unauthenticated remote attackers can exfiltrate sensitive database contents — including user records, order data, and credentials — by injecting arbitrary SQL through the profileId parameter.

Affected Products

• Smartcmsmarket Advance Seat Reservation Management for WooCommerce (WordPress plugin)
• All versions up to and including 3.3
• Deployments using the plugin on any WordPress site running WooCommerce

Discovery Timeline

• 2025-05-02 - CVE-2024-13344 published to NVD
• 2025-05-06 - Last updated in NVD database

Technical Details for CVE-2024-13344

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in a WooCommerce extension that manages seat reservations. The plugin accepts a profileId value from HTTP requests and concatenates it directly into a SQL query. Because the parameter is neither escaped nor passed through WordPress's prepared statement helpers, attackers can break out of the intended query context. The flaw is reachable without authentication, which removes the most common barrier to exploitation in WordPress plugin attacks.

Successful exploitation enables UNION-based or stacked-query extraction of database contents. Targets typically include the wp_users table for password hashes and the wp_usermeta table for session tokens and capabilities. Booking and customer data stored by WooCommerce and the seat reservation plugin are also at risk.

Root Cause

The root cause is insufficient input sanitization combined with the absence of parameterized queries. The plugin does not invoke $wpdb->prepare() with proper placeholders, nor does it cast the profileId value to an integer before use. Any string passed in the parameter is interpolated into the raw SQL statement executed against the WordPress database.

Attack Vector

The attack is delivered over the network through normal HTTP(S) requests to the WordPress site. No user interaction or prior authentication is required. An attacker crafts a request that supplies a malicious value for the profileId parameter, appending SQL syntax such as a UNION SELECT clause to retrieve arbitrary columns from arbitrary tables. The confidentiality impact is high, while integrity and availability are not directly affected according to the published CVSS vector.

Detailed exploitation specifics are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13344

Indicators of Compromise

• HTTP requests containing SQL syntax in the profileId parameter, such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or URL-encoded equivalents (%20UNION%20, %27).
• Unexpected outbound responses with abnormally large payload sizes from endpoints that process seat reservation requests.
• Web server access logs showing repeated requests to plugin endpoints with varying profileId values from a single source IP.
• Database error messages logged by PHP referencing syntax errors near plugin-related tables.

Detection Strategies

• Deploy WAF rules that inspect the profileId query string and POST body for SQL metacharacters and known injection payloads.
• Enable WordPress debug logging and monitor wp-content/debug.log for wpdb errors originating from the seat reservation plugin.
• Correlate web access logs with database query logs to identify queries whose structure differs from the plugin's normal patterns.

Monitoring Recommendations

• Alert on any unauthenticated request to plugin endpoints that contains SQL keywords in parameter values.
• Track failed login attempts and password reset activity immediately following suspicious profileId traffic, which may indicate harvested credentials.
• Review WooCommerce order tables and wp_users for unauthorized read patterns by enabling MySQL general query logging on a sampled basis.

How to Mitigate CVE-2024-13344

Immediate Actions Required

• Disable the Advance Seat Reservation Management for WooCommerce plugin until a patched version is confirmed installed.
• Block requests containing SQL metacharacters in the profileId parameter at the WAF or reverse proxy layer.
• Rotate WordPress administrator and WooCommerce API credentials, and invalidate active sessions if exploitation is suspected.
• Audit the database for unauthorized reads against wp_users, wp_usermeta, and WooCommerce order tables.

Patch Information

As of the last NVD update on 2025-05-06, all versions of the plugin up to and including 3.3 are vulnerable. Administrators should consult the vendor's listing on CodeCanyon for a fixed release and verify the installed version against the Wordfence advisory before re-enabling the plugin.

Workarounds

• Remove or deactivate the plugin entirely if seat reservation functionality is not business-critical.
• Restrict access to plugin endpoints to authenticated administrators using web server access controls.
• Apply a virtual patch in the WAF that enforces profileId to be a strict integer and rejects all other input.
• Place the WordPress database user under least-privilege so the plugin's connection cannot read tables outside its required scope.

# Example ModSecurity rule to enforce integer-only profileId values
SecRule ARGS:profileId "!@rx ^[0-9]+$" \
    "id:1013344,phase:2,deny,status:403,\
     msg:'CVE-2024-13344 - Non-integer profileId blocked',\
     logdata:'profileId=%{ARGS.profileId}'"