CVE-2024-30488: Katieseaborn Zotpress SQLI Vulnerability

CVE-2024-30488 Overview

CVE-2024-30488 is a SQL injection vulnerability in the Zotpress WordPress plugin developed by Katie Seaborn. The flaw affects all versions of Zotpress up to and including 7.3.7. An authenticated attacker with low privileges can inject malicious SQL statements through unsanitized input, resulting in unauthorized database access, data modification, or full compromise of the WordPress backend. The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can extract sensitive data, tamper with database contents, and disrupt WordPress site availability by exploiting improper input neutralization in Zotpress.

Affected Products

Katie Seaborn Zotpress plugin for WordPress
All versions from n/a through 7.3.7
WordPress sites using Zotpress for Zotero bibliography management

Discovery Timeline

2024-03-29 - CVE-2024-30488 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30488

Vulnerability Analysis

The Zotpress plugin fails to properly neutralize special elements used in SQL commands before passing user-supplied input to the underlying database. This category of flaw (CWE-89) allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

Because the vulnerability is exploitable over the network and only requires low-level authenticated access, any user with plugin interaction privileges becomes a viable attack vector. Successful exploitation can compromise confidentiality, integrity, and availability of the WordPress database.

Root Cause

The root cause is missing or insufficient input validation and parameterization in one or more Zotpress database queries. Instead of using prepared statements or the WordPress $wpdb->prepare() API with strict placeholders, the affected code paths concatenate user-controlled values directly into SQL strings.

Attack Vector

An authenticated attacker sends crafted requests to Zotpress endpoints that accept parameters used in database lookups. By supplying SQL metacharacters and payload fragments, the attacker forces the database to execute unintended queries. Consult the Patchstack Zotpress SQL Injection Advisory for specific parameter details.

No public proof-of-concept exploit or CISA KEV listing exists at the time of publication. The current EPSS probability is 0.594%.

Detection Methods for CVE-2024-30488

Indicators of Compromise

Unexpected WordPress database queries containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in Zotpress request parameters
HTTP requests to Zotpress endpoints containing encoded quotes, comment markers (--, #), or stacked query separators (;)
Anomalous read activity against the wp_users, wp_usermeta, or Zotpress-specific tables
Sudden spikes in database error responses associated with Zotpress URLs

Detection Strategies

Deploy web application firewall (WAF) rules that inspect Zotpress request parameters for SQL injection signatures
Enable MySQL/MariaDB general query logging on staging environments to profile expected Zotpress query patterns
Correlate authenticated WordPress user sessions with abnormal query volume or response sizes
Review Zotpress-related audit logs for parameter tampering by low-privileged accounts

Monitoring Recommendations

Alert on WordPress plugin requests that return HTTP 500 responses combined with database error strings
Monitor for outbound data transfers from the web server following Zotpress endpoint access
Track privilege escalation events such as new administrator account creation shortly after Zotpress interactions

How to Mitigate CVE-2024-30488

Immediate Actions Required

Update Zotpress to a version later than 7.3.7 as soon as a patched release is available from the vendor
Restrict Zotpress usage to trusted authenticated users and audit existing low-privileged accounts
Rotate WordPress administrator passwords and database credentials if exploitation is suspected
Review the Patchstack Zotpress Vulnerability Details for vendor guidance

Patch Information

As of the NVD publication, the advisory documents the issue as affecting Zotpress <= 7.3.7. Administrators should consult the Patchstack advisory and the plugin repository for the latest fixed release and apply it across all WordPress installations.

Workarounds

Temporarily deactivate and remove the Zotpress plugin until a patched version is installed
Deploy a virtual patch through a WordPress-aware WAF such as Patchstack, Wordfence, or a cloud WAF service
Enforce least privilege by removing plugin access from accounts that do not require Zotero bibliography features
Restrict administrative endpoints via IP allowlisting where feasible

bash

# Example: disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate zotpress
wp plugin status zotpress