CVE-2024-13507 Overview
CVE-2024-13507 is a time-based SQL Injection vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. The flaw affects all versions up to and including 2.8.97. It stems from insufficient escaping on the user-supplied dist parameter combined with inadequate preparation of the existing SQL query. Unauthenticated attackers can append additional SQL queries to existing queries to extract sensitive information from the WordPress database.
Critical Impact
Unauthenticated network-based attackers can extract sensitive data from the WordPress database using time-based SQL injection through the dist parameter.
Affected Products
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress
- All versions up to and including 2.8.97
- WordPress sites running the vulnerable plugin in default configuration
Discovery Timeline
- 2025-07-26 - CVE-2024-13507 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13507
Vulnerability Analysis
The vulnerability is classified as SQL Injection [CWE-89]. The GeoDirectory plugin processes the dist parameter and incorporates it into an SQL query without sufficient sanitization or parameterization. Attackers manipulate this input to break out of the intended query context and append arbitrary SQL fragments.
The injection technique is time-based, meaning attackers infer query results by measuring response delays induced by SQL functions such as SLEEP() or BENCHMARK(). This blind exfiltration technique allows extraction of database content one bit or character at a time, without requiring visible output in the HTTP response.
The vulnerable code path resides in includes/class-geodir-query.php within the plugin source tree. Reviewing the referenced line in the plugin repository shows the dist value being concatenated into the query rather than bound through prepared statements.
Root Cause
The root cause is twofold: insufficient escaping on the user-supplied dist parameter, and lack of sufficient preparation on the existing SQL query. WordPress provides $wpdb->prepare() for parameterized queries, but the affected query path does not use it correctly for the dist value. This omission allows attacker-controlled input to alter query structure.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests targeting the plugin endpoint that consumes the dist parameter. By injecting time-delay SQL payloads, the attacker observes response timing to extract data such as user credentials, password hashes, session tokens, and configuration values from the WordPress database.
The vulnerability is described in prose only. No verified proof-of-concept code is published in the referenced sources. Refer to the Wordfence Vulnerability Analysis and the WordPress Geodirectory Code Review for the source location of the unsafe query.
Detection Methods for CVE-2024-13507
Indicators of Compromise
- HTTP requests containing the dist parameter with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or encoded variants
- Web server access logs showing repeated requests to GeoDirectory endpoints with unusually high response times
- Database query logs containing unexpected SLEEP() or BENCHMARK() function calls originating from plugin queries
- Outbound traffic patterns consistent with blind data exfiltration following requests to directory listing pages
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect the dist parameter for SQL metacharacters and time-delay functions
- Monitor WordPress slow query logs for queries originating from class-geodir-query.php with abnormal execution times
- Apply MySQL audit logging to capture queries containing time-delay functions invoked by the WordPress user
- Correlate HTTP request duration with parameter content to identify systematic timing-based probing
Monitoring Recommendations
- Track requests per minute against GeoDirectory endpoints from individual source IPs and alert on volume anomalies
- Capture full request URIs and POST bodies in access logging to support retrospective hunting for dist parameter abuse
- Aggregate WordPress and database telemetry into a centralized data lake for correlation across the request and query layers
How to Mitigate CVE-2024-13507
Immediate Actions Required
- Update the GeoDirectory plugin to a version newer than 2.8.97 that incorporates the upstream fix
- Audit WordPress sites for the presence of the GeoDirectory plugin and inventory affected versions
- Review database access logs and WordPress logs for prior exploitation attempts targeting the dist parameter
- Rotate WordPress administrator credentials and database secrets if exploitation indicators are present
Patch Information
The vendor committed a fix in the plugin trunk. See the WordPress Geodirectory Changeset for the code changes that introduce proper preparation of the SQL query handling the dist parameter. Site administrators should update through the WordPress plugin dashboard or via WP-CLI.
Workarounds
- Block or filter requests containing the dist parameter at the WAF or reverse proxy layer until the plugin is updated
- Restrict access to GeoDirectory directory listing endpoints to authenticated users where business logic permits
- Disable the GeoDirectory plugin temporarily if patching cannot be performed immediately
# Update GeoDirectory plugin using WP-CLI
wp plugin update geodirectory
wp plugin list --name=geodirectory --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
