CVE-2024-30497: WP Responsive Tabs SQLi Vulnerability

CVE-2024-30497 Overview

CVE-2024-30497 is an SQL injection vulnerability in the I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.17. An authenticated attacker with low privileges can inject crafted SQL statements through unsanitized input passed directly to database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database. The issue is tracked under CWE-89 and was disclosed through Patchstack.

Critical Impact
Authenticated attackers can extract, modify, or destroy WordPress database contents through crafted SQL payloads sent to the vulnerable plugin.

Affected Products

I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs plugin
All plugin versions from n/a through 1.1.17
WordPress installations with the plugin activated

Discovery Timeline

2024-03-29 - CVE-2024-30497 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30497

Vulnerability Analysis

The vulnerability stems from improper neutralization of special characters in SQL commands, classified under [CWE-89]. User-controllable input reaches SQL statements without adequate sanitization or parameterization. An attacker authenticated to WordPress with at least contributor-level privileges can supply malicious payloads that alter query semantics.

Exploitation requires network access to the WordPress site and low-privilege authentication. No user interaction is needed. A successful attack lets the adversary read arbitrary database contents, including WordPress user hashes, session tokens, and secret keys stored in wp_options. Attackers can also modify or delete records, enabling site takeover or content tampering.

The EPSS score of 0.577% places this vulnerability in the 44th percentile of exploitation likelihood. No public proof-of-concept or in-the-wild exploitation has been confirmed.

Root Cause

The plugin concatenates request parameters directly into SQL query strings rather than using prepared statements with $wpdb->prepare(). WordPress documentation requires developers to escape or parameterize any user-supplied value used in database queries. The plugin bypasses this safeguard on at least one code path reachable by authenticated users.

Attack Vector

The attack is delivered over the network to the WordPress HTTP endpoint exposed by the plugin. An authenticated request carrying a crafted parameter value triggers execution of attacker-controlled SQL. Because the query runs with the same MySQL user as WordPress itself, the attacker inherits full read and write access to every table in the database.

Verified exploitation details are documented by the reporting party. See the Patchstack SQL Injection Advisory for the sanitized technical reference.

Detection Methods for CVE-2024-30497

Indicators of Compromise

Unexpected UNION SELECT, SLEEP(), BENCHMARK(), or INFORMATION_SCHEMA strings in WordPress access logs targeting plugin endpoints
Anomalous database errors written to debug.log referencing plugin file paths under wp-content/plugins/responsive-horizontal-vertical-and-accordion-tabs/
New or modified WordPress administrator accounts that cannot be attributed to legitimate activity
Unusual outbound traffic from the web server following authenticated POST or GET requests to plugin handlers

Detection Strategies

Inspect web server and WordPress logs for encoded SQL metacharacters such as %27, %22, --, and 0x sequences in requests to the plugin
Enable WordPress WPDB query logging in a staging environment to identify unsanitized parameter concatenation
Deploy a web application firewall rule set that flags SQL injection patterns targeting plugin URLs

Monitoring Recommendations

Alert on authenticated low-privilege users issuing requests that trigger database errors or long query durations
Track file integrity of wp-content/plugins/ and wp-config.php to detect post-exploitation persistence
Correlate WordPress wp_users and wp_usermeta changes with source IP addresses and session identifiers

How to Mitigate CVE-2024-30497

Immediate Actions Required

Deactivate the WP Responsive Tabs plugin until a patched version is confirmed installed
Restrict WordPress account creation and audit all contributor, author, editor, and administrator accounts
Rotate WordPress secret keys in wp-config.php and force password resets for all users
Review database contents for unauthorized modifications introduced through the plugin

Patch Information

At the time of the advisory, the vendor had not published a fixed release above version 1.1.17. Monitor the WordPress.org plugin repository and the Patchstack SQL Injection Advisory for updated fix information. Apply any subsequent security release immediately and verify the plugin version reported inside the WordPress admin dashboard.

Workarounds

Remove the plugin directory wp-content/plugins/responsive-horizontal-vertical-and-accordion-tabs/ if the plugin is not business-critical
Deploy a virtual patching rule in a web application firewall to block SQL metacharacters on plugin endpoints
Restrict database privileges for the WordPress MySQL user to the minimum required for site operation
Limit contributor and author registration until a vendor patch is validated

bash

# Configuration example: deactivate the plugin via WP-CLI
wp plugin deactivate responsive-horizontal-vertical-and-accordion-tabs
wp plugin delete responsive-horizontal-vertical-and-accordion-tabs

# Restrict database privileges for the WordPress user
REVOKE ALL PRIVILEGES ON wordpress.* FROM 'wp_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;