CVE-2024-30241 Overview
CVE-2024-30241 is a SQL Injection vulnerability affecting the Metagauss ProfileGrid plugin for WordPress. The flaw exists in versions up to and including 5.7.1 and is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). An authenticated attacker with Contributor-level privileges can inject arbitrary SQL statements through unsanitized input handled by the plugin. Successful exploitation allows the attacker to read, modify, or delete database records used by the WordPress site, including user credentials and membership data. The vulnerability affects sites running ProfileGrid User Profiles, Memberships, Groups and Communities plugin, which manages community and profile features on WordPress.
Critical Impact
An authenticated contributor can execute arbitrary SQL queries against the WordPress database, exposing user profiles, credentials, and membership data.
Affected Products
- Metagauss ProfileGrid plugin for WordPress, all versions from n/a through 5.7.1
- WordPress sites using ProfileGrid User Profiles, Memberships, Groups and Communities
- Installations that permit Contributor-level accounts to interact with ProfileGrid endpoints
Discovery Timeline
- 2024-03-28 - CVE-2024-30241 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30241
Vulnerability Analysis
The vulnerability stems from improper neutralization of special elements within an SQL statement handled by the ProfileGrid plugin. User-controlled input reaches a database query without sufficient sanitization or parameterization. An authenticated user with Contributor-level access can craft input containing SQL metacharacters that alter the intended query structure. The plugin then executes the modified query against the WordPress database, granting the attacker read and write access to arbitrary tables. Because the plugin manages user profiles, groups, and memberships, exposed data typically includes password hashes, email addresses, session tokens, and community metadata.
Root Cause
The root cause is direct concatenation of untrusted input into an SQL query rather than the use of prepared statements or the WordPress $wpdb->prepare() function. The plugin trusts that Contributor-level users cannot abuse the affected endpoint, but the required privilege is low and easily obtained on sites that allow open registration or content contribution.
Attack Vector
The attack is delivered over the network with low complexity and requires low privileges without user interaction. An attacker first obtains a Contributor account, either through open registration or credential compromise. The attacker then sends a crafted HTTP request to the vulnerable ProfileGrid endpoint with SQL payload embedded in a parameter. The database server processes the injected query and returns results, or performs writes, according to the attacker's payload. See the Patchstack SQL Injection Advisory for technical details.
Detection Methods for CVE-2024-30241
Indicators of Compromise
- Unexpected HTTP POST or GET requests to ProfileGrid AJAX endpoints containing SQL metacharacters such as UNION, SLEEP(, single quotes, or comment sequences (--, #).
- Web server logs showing Contributor-authenticated sessions issuing repeated requests to /wp-admin/admin-ajax.php with action parameters referencing ProfileGrid handlers.
- MySQL slow query log entries containing anomalous UNION SELECT statements or references to wp_users from plugin queries.
- New or modified administrator accounts in wp_users that do not correspond to legitimate onboarding.
Detection Strategies
- Enable WordPress debug logging and audit database queries originating from ProfileGrid handlers for unexpected string concatenation patterns.
- Deploy a web application firewall rule that inspects request parameters bound for ProfileGrid endpoints for SQL syntax tokens.
- Correlate authentication events for Contributor accounts with subsequent requests to plugin AJAX handlers to identify anomalous session behavior.
Monitoring Recommendations
- Monitor for privilege changes on WordPress accounts, particularly Contributor to Administrator role transitions.
- Alert on outbound database dumps or long response payloads from admin-ajax.php associated with ProfileGrid.
- Track failed and successful login attempts against Contributor accounts to detect credential stuffing that precedes exploitation.
How to Mitigate CVE-2024-30241
Immediate Actions Required
- Update the Metagauss ProfileGrid plugin to a version later than 5.7.1 as soon as the vendor publishes a fixed release.
- Audit WordPress user accounts and remove or reduce privileges for any Contributor accounts that are not required.
- Rotate credentials, session tokens, and API keys stored in the WordPress database if exploitation is suspected.
- Review the wp_users and wp_usermeta tables for unauthorized administrator accounts or capability changes.
Patch Information
The vulnerability affects ProfileGrid versions up to and including 5.7.1. Administrators should consult the Patchstack SQL Injection Advisory for the current fixed version and apply the update through the WordPress plugin manager or by replacing the plugin files directly.
Workarounds
- Disable the ProfileGrid plugin until a patched version is installed if Contributor accounts cannot be restricted.
- Restrict registration so that new users default to Subscriber rather than Contributor, limiting the pool of accounts able to reach the vulnerable code path.
- Deploy a web application firewall with virtual patching rules that block SQL injection payloads targeting ProfileGrid AJAX actions.
- Enforce strong authentication and multi-factor authentication on all WordPress accounts to reduce the risk of Contributor account compromise.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
