CVE-2024-30486 Overview
CVE-2024-30486 is an SQL injection vulnerability in the Max Foundry Media Library Folders plugin for WordPress. The flaw affects all plugin versions up to and including 8.1.7. An authenticated attacker with author-level privileges can inject arbitrary SQL statements into database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated attackers with author-level access can execute arbitrary SQL queries, extract sensitive data, and modify WordPress database contents.
Affected Products
- Max Foundry Media Library Folders WordPress plugin, versions up to and including 8.1.7
- WordPress sites running the vulnerable plugin with author-level or higher user accounts
- Any WordPress installation exposing the plugin's affected endpoints over the network
Discovery Timeline
- 2024-03-29 - CVE-2024-30486 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30486
Vulnerability Analysis
The Media Library Folders plugin fails to properly sanitize user-supplied input before including it in SQL queries. An authenticated user with author privileges can supply crafted parameters to plugin endpoints that are concatenated directly into database queries. This allows the attacker to break out of the intended query context and inject arbitrary SQL clauses. The result is unauthorized data extraction, data modification, or destructive operations against the WordPress database.
Exploitation requires network access and low privileges, but no user interaction. The vulnerability affects all confidentiality, integrity, and availability dimensions of the database. Because WordPress databases store credentials, session tokens, and content, successful exploitation typically leads to full site compromise.
Root Cause
The root cause is missing or inadequate input neutralization in database query construction. The plugin builds SQL statements using string concatenation with author-controlled input rather than using prepared statements or WordPress's $wpdb->prepare() API. Special characters such as single quotes, semicolons, and SQL comment sequences pass through without escaping, allowing query manipulation.
Attack Vector
An attacker authenticates to WordPress using any account with author-level or higher permissions. The attacker then sends a crafted HTTP request to a vulnerable plugin endpoint, embedding SQL payloads within parameters the plugin uses in database queries. Payloads can leverage UNION-based extraction, boolean-based blind techniques, or time-based blind techniques to retrieve data from tables such as wp_users and wp_options. Refer to the Patchstack advisory for endpoint-specific technical details.
Detection Methods for CVE-2024-30486
Indicators of Compromise
- Unexpected SQL syntax such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or encoded quote characters in HTTP request parameters targeting the Media Library Folders plugin.
- Author-level WordPress accounts issuing high volumes of requests to plugin AJAX endpoints or admin-ajax.php actions associated with mlf or media-library-folders.
- Anomalous database errors in PHP or MySQL logs referencing plugin query paths.
- Creation of new administrator accounts or unexpected modifications to the wp_users and wp_usermeta tables.
Detection Strategies
- Deploy a web application firewall rule to identify SQL keywords and metacharacters in POST or GET parameters directed at plugin endpoints.
- Enable WordPress database query logging and alert on queries containing tautologies, stacked statements, or INFORMATION_SCHEMA references originating from plugin code paths.
- Correlate authenticated user session activity with SQL error rates to isolate accounts probing for injection points.
Monitoring Recommendations
- Monitor for privilege escalation events, particularly promotion of author accounts to administrator role.
- Track outbound data volumes from the web server to identify bulk exfiltration following successful injection.
- Review WordPress audit logs for author accounts accessing plugin functions outside their normal workflow.
How to Mitigate CVE-2024-30486
Immediate Actions Required
- Update Max Foundry Media Library Folders to a version later than 8.1.7 once a patched release is available from the vendor.
- Audit all WordPress user accounts with author-level or higher privileges and remove unused or untrusted accounts.
- Rotate WordPress database credentials and secret keys if exploitation is suspected.
- Review the Patchstack advisory for vendor patch status.
Patch Information
At the time of NVD publication, the vulnerability affects Media Library Folders through version 8.1.7. Administrators should consult the Patchstack advisory and the vendor's plugin page for the current fixed version and apply it immediately.
Workarounds
- Deactivate and remove the Media Library Folders plugin until a patched version can be installed.
- Restrict author-level account creation and enforce multi-factor authentication for all privileged WordPress users.
- Deploy a WordPress-aware web application firewall with virtual patching signatures targeting this CVE.
- Limit access to /wp-admin/ and admin-ajax.php by IP address where operationally feasible.
# Disable the vulnerable plugin via WP-CLI until a patched version is installed
wp plugin deactivate media-library-plus
wp plugin delete media-library-plus
# Audit author-level and higher accounts
wp user list --role=author --fields=ID,user_login,user_email,user_registered
wp user list --role=editor --fields=ID,user_login,user_email,user_registered
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
