CVE-2024-13369 Overview
CVE-2024-13369 is a time-based SQL injection vulnerability in the Tour Master - Tour Booking, Travel, Hotel plugin for WordPress developed by GoodLayers. The flaw affects all plugin versions up to and including 5.3.7. The vulnerability exists in the handling of the review_id parameter, which lacks proper escaping and query preparation. Authenticated users with Subscriber-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows attackers to extract sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets. The issue is tracked under CWE-89: SQL Injection.
Critical Impact
Authenticated attackers with Subscriber-level access can extract arbitrary data from the WordPress database, including password hashes and secret keys, through the review_id parameter.
Affected Products
- GoodLayers Tour Master plugin for WordPress, all versions through 5.3.7
- WordPress sites using the Tour Master - Tour Booking, Travel, Hotel plugin
- Any WordPress installation permitting Subscriber registration with the vulnerable plugin active
Discovery Timeline
- 2025-02-18 - CVE-2024-13369 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13369
Vulnerability Analysis
The vulnerability stems from unsafe handling of the review_id request parameter inside the Tour Master plugin. The plugin concatenates the user-supplied value directly into a SQL statement without adequate sanitization or use of prepared statements. Because the injection point supports time-based blind extraction, attackers do not need query output to be reflected in the HTTP response. Instead, they use payloads containing SLEEP() or BENCHMARK() to infer database contents one bit at a time based on server response delays. WordPress database tables reachable through this injection include wp_users, wp_usermeta, and wp_options, which store password hashes, session tokens, and authentication secret keys.
Root Cause
The root cause is insufficient input escaping and the absence of parameter binding on the review_id value. The plugin fails to invoke $wpdb->prepare() with proper placeholders before executing the query. This CWE-89 pattern arises when developers construct SQL strings using concatenation instead of parameterized queries.
Attack Vector
Exploitation requires network access to the WordPress site and any authenticated account at Subscriber level or above. Subscriber accounts are typically created through open registration on WordPress sites, lowering the practical barrier. The attacker sends a crafted HTTP request containing malicious SQL syntax in the review_id parameter to the plugin's review endpoint. The injected payload extends the existing query and triggers conditional time delays that allow blind data extraction. No user interaction is required beyond the attacker's own authenticated session.
A complete technical breakdown is available in the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-13369
Indicators of Compromise
- HTTP requests to Tour Master plugin endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION SELECT, or WAITFOR inside the review_id parameter
- Unusually long response times from admin-ajax.php or Tour Master review handlers when accessed by low-privilege accounts
- Repeated authenticated requests from Subscriber accounts targeting the same review endpoint with incrementally changing parameter values
- New or unexpected Subscriber-level user registrations preceding suspicious query activity
Detection Strategies
- Inspect web server access logs for review_id parameter values containing SQL metacharacters, comment sequences (--, #), or encoded delay functions
- Enable MySQL slow query logging and correlate long-running queries with the originating HTTP request and authenticated user
- Deploy a Web Application Firewall (WAF) with signatures targeting time-based SQL injection payloads against WordPress plugin parameters
Monitoring Recommendations
- Alert on authenticated requests from Subscriber accounts that trigger response times exceeding a defined baseline threshold
- Monitor the WordPress wp_users and wp_options tables for unauthorized read patterns or exports from the database host
- Track outbound connections and data volumes from the WordPress host to detect data exfiltration following successful extraction
How to Mitigate CVE-2024-13369
Immediate Actions Required
- Update the GoodLayers Tour Master plugin to a version later than 5.3.7 as published in the GoodLayers Tour Master Changelog
- Audit and disable open user registration on WordPress sites where Subscriber accounts are not required for business operations
- Rotate WordPress secret keys in wp-config.php and force password resets for all administrative accounts if compromise is suspected
- Review recent Subscriber account creations and remove accounts that show no legitimate activity
Patch Information
Refer to the GoodLayers Tour Master Changelog for the fixed release version. Apply the update through the WordPress plugin manager or by replacing the plugin files with the vendor-supplied package. After patching, verify that the review_id parameter is processed through $wpdb->prepare() with typed placeholders.
Workarounds
- Deactivate the Tour Master plugin until a patched version can be installed if the affected functionality is not business-critical
- Restrict access to plugin endpoints using a WAF rule that blocks non-numeric values in the review_id parameter
- Remove or downgrade the Subscriber role privileges to prevent registered users from reaching the vulnerable endpoint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
