CVE-2024-30491 Overview
CVE-2024-30491 is a SQL Injection vulnerability affecting the Metagauss ProfileGrid plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all versions of ProfileGrid from initial release through 5.7.8. Authenticated attackers with low-level privileges can exploit the vulnerability over the network to inject arbitrary SQL statements. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database.
Critical Impact
Authenticated attackers can inject arbitrary SQL statements against the WordPress database, extracting sensitive user data, modifying records, and potentially escalating access. EPSS scoring places this issue in the 98th percentile for exploitation likelihood.
Affected Products
- Metagauss ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress
- All versions from initial release through 5.7.8
- WordPress deployments with the ProfileGrid plugin enabled
Discovery Timeline
- 2024-03-29 - CVE-2024-30491 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30491
Vulnerability Analysis
The vulnerability resides in the Metagauss ProfileGrid WordPress plugin, which provides user profile, membership, and community functionality. One or more plugin request handlers accept user-controlled input and pass it into SQL queries without proper sanitization or parameterization. The result is a classic SQL injection condition classified under CWE-89.
Exploitation requires low privileges, meaning any authenticated user with a valid session, including standard subscriber-level accounts commonly issued by WordPress sites running ProfileGrid, can send crafted requests. Because the plugin operates within the WordPress database context, injected queries execute against the same schema that stores users, hashed passwords, session tokens, and site configuration.
Root Cause
The root cause is improper neutralization of special elements in a SQL command. Plugin code concatenates untrusted request parameters directly into SQL statements instead of using parameterized queries with the WordPress $wpdb->prepare() API. This allows metacharacters such as single quotes, comments, and UNION operators to alter query structure.
Attack Vector
The attack vector is remote and requires network access to the WordPress site plus authenticated credentials. An attacker submits a crafted HTTP request to a vulnerable ProfileGrid endpoint with SQL payloads embedded in a parameter processed by the plugin. No user interaction is required beyond the attacker's own authenticated session. See the Patchstack SQL Injection Advisory for endpoint-specific details.
No verified public proof-of-concept code is available for this vulnerability at the time of writing.
Detection Methods for CVE-2024-30491
Indicators of Compromise
- Unexpected SQL syntax such as UNION SELECT, SLEEP(, --, or information_schema in HTTP request parameters targeting ProfileGrid endpoints
- Anomalous outbound HTTP requests from the web server following ProfileGrid form submissions
- New or modified rows in wp_users, wp_usermeta, or ProfileGrid-owned tables that do not correlate with legitimate admin activity
- Web server access logs showing repeated authenticated requests to ProfileGrid AJAX or REST endpoints from a single account
Detection Strategies
- Inspect PHP and MySQL query logs for malformed statements referencing ProfileGrid tables and parameters
- Deploy web application firewall (WAF) rules that identify SQL injection payloads against /wp-admin/admin-ajax.php and ProfileGrid REST routes
- Correlate authenticated session activity with database error responses returned to the client
Monitoring Recommendations
- Enable and centralize WordPress debug logs, PHP error logs, and MySQL general query logs for the affected site
- Alert on privilege changes to WordPress user roles, especially promotions to administrator
- Baseline normal ProfileGrid endpoint traffic and alert on volume spikes or long request bodies from authenticated low-privilege users
How to Mitigate CVE-2024-30491
Immediate Actions Required
- Update the Metagauss ProfileGrid plugin to a version later than 5.7.8 as soon as the vendor patch is available
- Audit all WordPress user accounts, especially recently created subscriber-level accounts, and revoke any suspicious sessions
- Rotate WordPress database credentials, administrator passwords, and secret keys defined in wp-config.php if compromise is suspected
- Review the wp_users and wp_options tables for unauthorized modifications
Patch Information
Refer to the Patchstack SQL Injection Advisory for the fixed release information. Administrators should install the vendor-supplied update through the WordPress plugin manager and verify the installed version exceeds 5.7.8.
Workarounds
- Temporarily disable the ProfileGrid plugin until the patched version can be installed
- Restrict registration on affected WordPress sites to prevent unauthenticated attackers from obtaining the low-privilege accounts required for exploitation
- Deploy WAF signatures that block SQL injection patterns targeting ProfileGrid request parameters
- Apply the principle of least privilege to the MySQL account used by WordPress so it cannot access unrelated databases
# Configuration example: identify installed ProfileGrid version and disable the plugin via WP-CLI
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version
wp plugin deactivate profilegrid-user-profiles-groups-and-communities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
