CVE-2024-22154: Snpdigital Salesking Information Disclosure

CVE-2024-22154 Overview

CVE-2024-22154 is an unauthenticated sensitive data exposure vulnerability in the SNP Digital SalesKing plugin for WordPress. The flaw affects all plugin versions up to and including 1.6.15. Remote attackers can retrieve sensitive information over the network without authentication or user interaction. The weakness maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

Unauthenticated remote attackers can extract sensitive data from WordPress sites running SalesKing 1.6.15 or earlier, exposing confidential business and customer information without leaving authentication traces.

Affected Products

• SNP Digital SalesKing WordPress plugin versions through 1.6.15
• WordPress sites with the SalesKing plugin installed and active
• Deployments exposing the plugin endpoints to the public internet

Discovery Timeline

• 2024-01-24 - CVE-2024-22154 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22154

Vulnerability Analysis

The SalesKing plugin exposes data through endpoints that do not enforce authentication or authorization checks. An unauthenticated remote attacker sends crafted HTTP requests to the plugin and receives sensitive records in the response. The vulnerability impacts confidentiality only, leaving integrity and availability unaffected, which is consistent with read-only information disclosure.

Because SalesKing is a sales and quoting solution for WordPress, the exposed data typically includes customer details, quote contents, and related business records. Attackers can iterate through identifiers or query parameters to enumerate stored objects at scale.

Root Cause

The root cause is missing access control on plugin endpoints that return business data. The plugin fails to verify whether the requester holds a valid session or the required capabilities before serving responses. This pattern is common in WordPress plugins that rely on admin-ajax.php or REST routes without registering proper permission_callback handlers.

Attack Vector

The attack vector is the network. An attacker only needs HTTP reachability to the vulnerable WordPress installation. No credentials, no user interaction, and no elevated privileges are required. The unauthenticated nature of the flaw enables automated scanning and mass exploitation across exposed WordPress sites.

The vulnerability mechanism is described in the Patchstack Vulnerability Database Entry. No public proof-of-concept exploit code has been verified at the time of writing, and the EPSS score is 0.52% at the 40.04 percentile.

Detection Methods for CVE-2024-22154

Indicators of Compromise

• Unauthenticated HTTP GET or POST requests to SalesKing plugin paths under /wp-content/plugins/salesking/ or related AJAX and REST endpoints
• Anomalous response sizes from plugin endpoints indicating bulk data returns
• Sequential identifier enumeration patterns in web server access logs targeting plugin parameters
• Requests originating from known scanning infrastructure or anonymizing proxies

Detection Strategies

• Inspect WordPress access logs for unauthenticated requests to SalesKing endpoints returning HTTP 200 responses with non-trivial payload sizes
• Deploy web application firewall rules that flag access to plugin routes without an authenticated session cookie
• Correlate plugin version inventory against 1.6.15 and earlier to identify exposed instances

Monitoring Recommendations

• Forward WordPress and reverse proxy logs into a centralized analytics platform to baseline normal plugin traffic and surface bulk enumeration
• Alert on spikes in outbound response volume from /wp-admin/admin-ajax.php and REST API routes tied to SalesKing
• Track plugin inventory across managed WordPress fleets and trigger alerts when vulnerable versions reappear after patching

How to Mitigate CVE-2024-22154

Immediate Actions Required

• Identify every WordPress site running SalesKing and confirm the installed version against 1.6.15
• Update the SalesKing plugin to a version newer than 1.6.15 once the vendor releases a fixed build
• Restrict access to the WordPress admin and plugin endpoints using IP allowlists or authentication at the reverse proxy layer until patching completes
• Rotate any credentials, API keys, or customer-facing tokens that may have been exposed through the plugin

Patch Information

Review the Patchstack Vulnerability Database Entry for the latest fixed version guidance from SNP Digital. Apply the vendor-supplied update through the WordPress plugin updater or by replacing the plugin directory with the patched release.

Workarounds

• Deactivate and remove the SalesKing plugin if a patched version is not yet available for your deployment
• Place web application firewall rules in front of the affected endpoints to block unauthenticated requests to SalesKing routes
• Limit plugin endpoint exposure to authenticated internal networks using reverse proxy access controls

# Example: block unauthenticated access to SalesKing endpoints at the reverse proxy
location ~* /wp-content/plugins/salesking/ {
    satisfy all;
    allow 10.0.0.0/8;
    deny all;
}