CVE-2024-13496: GamiPress WordPress Plugin SQLi Flaw

CVE-2024-13496 Overview

The GamiPress gamification plugin for WordPress contains a time-based SQL injection vulnerability in the orderby parameter. The flaw affects all versions up to and including 7.3.1. Unauthenticated attackers can append arbitrary SQL queries to existing database statements through insufficient input escaping and a lack of query preparation. Successful exploitation allows extraction of sensitive data from the underlying WordPress database.

The vulnerability was initially reported as patched in version 7.2.2, but the vendor later confirmed that 7.3.2 is the correct fixed release. The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can extract sensitive data, including user credentials and session tokens, from WordPress sites running vulnerable GamiPress versions.

Affected Products

GamiPress plugin for WordPress, all versions through 7.3.1
WordPress sites with the GamiPress AJAX endpoints enabled
Sites depending on the ct-query query builder shipped with GamiPress

Discovery Timeline

2025-01-22 - CVE-2024-13496 published to NVD
2025-03-24 - Last updated in NVD database

Technical Details for CVE-2024-13496

Vulnerability Analysis

GamiPress exposes AJAX handlers that build SQL ORDER BY clauses from client-supplied input. The orderby parameter flows into the ct-query query construction logic without parameterized binding. WordPress's $wpdb->prepare() API cannot directly parameterize identifiers such as column names, so plugins must validate ORDER BY values against an allow-list. GamiPress failed to enforce this allow-list, allowing attacker-controlled SQL fragments to reach the query string.

Because the response does not echo query results directly, exploitation relies on time-based blind techniques. Attackers inject conditional SLEEP() or BENCHMARK() payloads and infer data character-by-character from response latency. Sensitive WordPress tables, including wp_users and wp_usermeta, can be enumerated without authentication.

Root Cause

The root cause is improper neutralization of the orderby parameter inside the AJAX function defined in includes/ajax-functions.php and the query builder at libraries/ct/includes/class-ct-query.php. User input is concatenated into the SQL statement rather than restricted to a vetted column list. See the WordPress Plugin Code Reference and the WordPress Plugin Class Reference.

Attack Vector

The attack is remote and unauthenticated. An attacker sends a crafted HTTP request to the WordPress AJAX endpoint, setting orderby to a payload that combines a benign column with appended SQL such as a conditional time delay. By measuring server response time, the attacker performs blind extraction of database contents. Technical write-up details are available in the Abrahack SQL Injection Post and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13496

Indicators of Compromise

HTTP requests to admin-ajax.php containing orderby values with SQL keywords such as SLEEP, BENCHMARK, IF(, CASE WHEN, or UNION SELECT
Unusually long response times from admin-ajax.php correlated with GamiPress AJAX actions
Repeated requests from a single source iterating over similar orderby payloads

Detection Strategies

Inspect web server and WordPress access logs for orderby parameters containing non-alphanumeric content or SQL syntax
Deploy a Web Application Firewall (WAF) rule that blocks SQL keywords in the orderby query parameter on GamiPress AJAX routes
Enable MySQL slow query logging to surface time-delayed statements consistent with SLEEP()-based injection

Monitoring Recommendations

Alert on HTTP 200 responses with latency exceeding a baseline threshold on admin-ajax.php requests
Track outbound database errors and unusual query patterns originating from the WordPress wpdb layer
Correlate repeated AJAX calls from the same IP that vary only in the orderby payload

How to Mitigate CVE-2024-13496

Immediate Actions Required

Upgrade GamiPress to version 7.3.2 or later on every WordPress instance
Audit prior access logs for orderby payloads containing SQL syntax and investigate any matches
Rotate WordPress administrator passwords and API keys if exploitation is suspected

Patch Information

The vendor fixed the vulnerability in GamiPress 7.3.2. Review the upstream change in WordPress Changeset #3226227. The patch enforces validation of the orderby parameter against an allow-list of permitted column names before constructing the SQL query.

Workarounds

Deactivate the GamiPress plugin until the site can be updated to 7.3.2
Add WAF signatures that reject requests where orderby contains characters other than [A-Za-z0-9_] or known column names
Restrict access to wp-admin/admin-ajax.php from untrusted networks where business requirements allow

bash

# Example ModSecurity rule to block SQL syntax in the orderby parameter
SecRule ARGS:orderby "@rx (?i)(sleep|benchmark|union|select|case\s+when|if\s*\()" \
    "id:1004913,phase:2,deny,status:403,log,msg:'CVE-2024-13496 GamiPress SQLi attempt'"