CVE-2024-13440 Overview
CVE-2024-13440 is a SQL Injection vulnerability in the Super Store Finder plugin for WordPress. The flaw affects all versions up to and including 7.0. It exists in the ssf_wp_user_name parameter, which lacks proper escaping and parameterization in the underlying SQL query.
Unauthenticated attackers can append additional SQL statements to existing queries. Successful exploitation allows attackers to store cross-site scripting (XSS) payloads in store reviews. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated attackers can inject SQL into the ssf_wp_user_name parameter to store persistent XSS in store reviews, leading to confidentiality impact and downstream session or credential theft.
Affected Products
- Super Store Finder plugin for WordPress, all versions up to and including 7.0
- WordPress sites with the superstorefinder/super_store_finder plugin installed
- Any store review functionality dependent on the vulnerable parameter
Discovery Timeline
- 2025-02-09 - CVE-2024-13440 published to NVD
- 2025-02-13 - Last updated in NVD database
Technical Details for CVE-2024-13440
Vulnerability Analysis
The Super Store Finder plugin processes the ssf_wp_user_name parameter without applying sufficient input sanitization. The plugin passes user-controlled input directly into an SQL statement without parameterized queries or proper escaping routines such as wpdb::prepare().
Attackers can break out of the intended query context by injecting SQL syntax through this parameter. Because the injection point is reachable without authentication, the attack surface is exposed to any unauthenticated visitor of the WordPress site. The exploitation outcome targets stored cross-site scripting in store review content rather than direct data exfiltration.
This bug chains a SQL Injection primitive into a stored XSS payload, persisting malicious JavaScript that executes when administrators or visitors view affected reviews.
Root Cause
The root cause is insufficient escaping of the user-supplied ssf_wp_user_name parameter combined with the absence of prepared statements. The plugin concatenates the parameter into an SQL query string instead of binding it as a parameter. This pattern is the canonical [CWE-89] failure mode and bypasses WordPress's built-in $wpdb->prepare() protections.
Attack Vector
The attack is delivered over the network and requires no authentication or user interaction. An attacker crafts an HTTP request containing a malicious payload in the ssf_wp_user_name parameter. The payload terminates the existing SQL statement and appends a secondary query that writes attacker-controlled content into the store reviews table.
When administrators or site visitors load the affected reviews page, the stored XSS payload executes in their browser context. This can lead to session hijacking, administrative account takeover, or redirection to attacker infrastructure. See the Wordfence Vulnerability Analysis for additional context.
Detection Methods for CVE-2024-13440
Indicators of Compromise
- HTTP requests containing SQL meta-characters such as ', UNION, SELECT, or -- in the ssf_wp_user_name parameter
- Unexpected entries or HTML/JavaScript content in the store reviews table within the WordPress database
- Anomalous outbound requests originating from administrator browser sessions after viewing store reviews
- WordPress error log entries referencing SQL syntax errors tied to the Super Store Finder plugin
Detection Strategies
- Inspect web server access logs for POST or GET requests targeting Super Store Finder endpoints with suspicious parameter values
- Deploy a web application firewall (WAF) rule that flags SQL Injection signatures against the ssf_wp_user_name parameter
- Run database integrity scans on review tables to identify rows containing <script> tags or encoded JavaScript
- Monitor for the presence of plugin versions at or below 7.0 across managed WordPress sites
Monitoring Recommendations
- Centralize WordPress access and error logs into a SIEM for correlation across multiple sites
- Alert on repeated 500-level responses from Super Store Finder endpoints, which often indicate injection probing
- Track administrator session anomalies such as new admin user creation or unexpected privilege changes following review page access
How to Mitigate CVE-2024-13440
Immediate Actions Required
- Upgrade the Super Store Finder plugin to a version beyond 7.0 that addresses the SQL Injection flaw, per the Super Store Finder Patch Notes
- Audit the WordPress reviews table for stored XSS payloads and remove any malicious entries
- Rotate administrator credentials and invalidate active sessions if exploitation indicators are found
Patch Information
The vendor has published patch notes addressing this vulnerability. Refer to the Super Store Finder Patch Notes for the fixed release version and upgrade instructions. Apply the patch through the WordPress admin plugin updater or by replacing the plugin files manually.
Workarounds
- Deactivate and remove the Super Store Finder plugin until the patched version can be deployed
- Deploy a WAF rule blocking SQL meta-characters in requests to Super Store Finder endpoints
- Restrict access to store review submission endpoints by IP allowlisting where business requirements permit
- Enable a Content Security Policy (CSP) that limits inline script execution to reduce the impact of stored XSS payloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
