CVE-2024-1893 Overview
CVE-2024-1893 is a time-based SQL injection vulnerability in the Easy Property Listings plugin for WordPress. The flaw affects all versions up to and including 3.5.2 and stems from insufficient escaping of the property_status shortcode attribute combined with missing query preparation. Authenticated attackers with Contributor-level access or higher can append additional SQL clauses to existing queries. Successful exploitation lets attackers extract sensitive data from the WordPress database, including credentials and personally identifiable information. The vulnerability is tracked under CWE-89 and was fixed in version 3.5.3 by the plugin maintainer, realestateconnected.
Critical Impact
Authenticated Contributors can exfiltrate arbitrary database contents through injected SQL payloads embedded in the property_status shortcode attribute.
Affected Products
- Easy Property Listings for WordPress versions up to and including 3.5.2
- WordPress installations with Contributor-or-higher user registration enabled
- Realestateconnected easy_property_listings plugin (all builds prior to 3.5.3)
Discovery Timeline
- 2024-04-09 - CVE-2024-1893 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1893
Vulnerability Analysis
The vulnerability exists in the shortcode handler defined in lib/includes/functions.php around line 1846 of Easy Property Listings 3.5.2. The plugin passes the property_status shortcode attribute into a database query without escaping the value or preparing the statement through wpdb::prepare(). Because the attribute value is concatenated directly into the SQL string, an attacker controlling the shortcode content can break out of the intended clause and append arbitrary SQL. The injection is time-based, meaning the attacker infers data by measuring response delays produced by payloads such as SLEEP() conditions. This channel is reliable even when the plugin returns no direct output from the injected query.
Root Cause
The root cause is a classic failure to separate code from data in SQL construction (CWE-89). The property_status value flows from a user-controlled shortcode attribute into the query string without sanitization, and the existing query lacks parameterized placeholders. WordPress provides wpdb::prepare() and esc_sql() helpers, neither of which the vulnerable code path invokes on this attribute.
Attack Vector
Exploitation requires an authenticated account with the Contributor role or higher, which is a low bar on sites that accept guest author submissions. The attacker embeds a crafted [epl_...] shortcode with a malicious property_status value into a post or page they control. When the page is rendered, the plugin executes the tainted query and returns timing-observable results to the attacker. Because the injection runs in the WordPress database context, the attacker can enumerate the wp_users table, dump password hashes, and read secrets stored by other plugins.
No verified public proof-of-concept code is available. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2024-1893
Indicators of Compromise
- Post or page revisions containing [epl_*] shortcodes with property_status values that include SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT.
- Unusually long page render times correlated with Contributor or Author account activity.
- Web server access logs showing repeated requests to preview or render pages that embed Easy Property Listings shortcodes.
Detection Strategies
- Review the WordPress wp_posts table for post_content entries containing property_status attribute values with non-alphanumeric characters, quotes, or SQL syntax.
- Enable MySQL general or slow query logging and search for queries against Easy Property Listings tables containing time-delay functions.
- Correlate authenticated low-privilege user sessions with anomalous outbound data volumes from the database host.
Monitoring Recommendations
- Alert on newly created Contributor or Author accounts followed by immediate post drafts containing shortcodes.
- Monitor PHP error logs for wpdb warnings referencing the plugin's query paths.
- Track file integrity for lib/includes/functions.php inside the easy-property-listings plugin directory to confirm the patched version is deployed.
How to Mitigate CVE-2024-1893
Immediate Actions Required
- Update Easy Property Listings to version 3.5.3 or later on every affected WordPress site.
- Audit existing Contributor, Author, and Editor accounts and disable any that are unused or unrecognized.
- Rotate WordPress administrator passwords and any secrets stored in the database if the plugin has been reachable by untrusted users.
Patch Information
The maintainer released version 3.5.3, which corrects the query construction in the shortcode handler. Review the fix in the WordPress Plugin Change Log. Sites using managed WordPress hosting should confirm automatic plugin updates are enabled and that version 3.5.3 or later is installed.
Workarounds
- If patching is delayed, deactivate the Easy Property Listings plugin until the update can be applied.
- Restrict the Contributor role from using unfiltered shortcodes by removing the edit_posts capability from untrusted users.
- Deploy a web application firewall rule that blocks requests carrying property_status parameters containing SQL metacharacters.
# Configuration example: update the plugin via WP-CLI
wp plugin update easy-property-listings --version=3.5.3
wp plugin list --name=easy-property-listings --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
