CVE-2024-30499: CRM Perks Forms SQL Injection Vulnerability

CVE-2024-30499 Overview

CVE-2024-30499 is a SQL injection vulnerability in the CRM Perks Forms plugin for WordPress. The flaw affects all versions up to and including 1.1.4. Attackers with low-privilege authenticated access can inject malicious SQL statements through unsanitized input, compromising the underlying database.

The vulnerability maps to [CWE-89], Improper Neutralization of Special Elements used in an SQL Command. Successful exploitation allows attackers to read, modify, or delete database contents, and in many WordPress deployments can lead to full site compromise.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session data, and site configuration.

Affected Products

CRM Perks Forms plugin for WordPress
All versions from n/a through 1.1.4
WordPress sites with the CRM Perks Forms plugin installed and activated

Discovery Timeline

2024-03-29 - CVE-2024-30499 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30499

Vulnerability Analysis

The vulnerability arises from improper neutralization of special characters in SQL queries constructed by the CRM Perks Forms plugin. User-supplied input reaches SQL query builders without adequate sanitization or parameterization. Attackers append SQL syntax to plugin parameters to alter query semantics.

Exploitation requires network access and low-privilege authentication. No user interaction is needed. The scope remains unchanged, but confidentiality, integrity, and availability of the database are all impacted.

Root Cause

The root cause is direct concatenation of untrusted input into SQL statements without using prepared statements or the WordPress $wpdb->prepare() function. When plugin endpoints handle form data, request parameters flow into database queries with insufficient escaping.

Attack Vector

An authenticated attacker sends crafted HTTP requests to plugin endpoints that process form data. The malicious payload contains SQL metacharacters such as single quotes, UNION SELECT clauses, or stacked queries. The database server executes the injected SQL as part of the plugin's intended query.

The vulnerability manifests in plugin parameters handled by CRM Perks Forms. See the Patchstack SQL Injection Advisory for technical details on the vulnerable code path.

Detection Methods for CVE-2024-30499

Indicators of Compromise

HTTP requests to CRM Perks Forms plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Unexpected database errors or timeouts logged by WordPress or the MySQL server
New or modified administrator accounts in the wp_users table without corresponding admin activity
Outbound requests from the web server following anomalous plugin traffic

Detection Strategies

Enable WordPress debug logging and inspect PHP error logs for MySQL syntax errors originating from the CRM Perks Forms plugin
Deploy a web application firewall with rules that identify SQL injection patterns targeting /wp-admin/admin-ajax.php and plugin endpoints
Baseline the plugin's normal query patterns and alert on queries containing UNION operators or information_schema references

Monitoring Recommendations

Monitor authenticated user activity on WordPress sites running CRM Perks Forms, focusing on low-privilege accounts issuing plugin requests
Track query volume and error rates in MySQL slow query and general logs for the WordPress database user
Alert on modifications to sensitive tables including wp_users, wp_usermeta, and wp_options

How to Mitigate CVE-2024-30499

Immediate Actions Required

Update CRM Perks Forms to a version later than 1.1.4 as soon as a patched release is available from the vendor
Audit the WordPress wp_users table for unauthorized accounts and rotate credentials for all administrative users
Review database and web server logs for evidence of prior exploitation attempts against plugin endpoints
Restrict form submission capabilities to trusted authenticated users only

Patch Information

Refer to the Patchstack SQL Injection Advisory for vendor patch status. Sites running affected versions should upgrade immediately or deactivate the plugin until a fixed release is confirmed.

Workarounds

Deactivate and remove the CRM Perks Forms plugin until a patched version is installed
Deploy a web application firewall rule set that blocks SQL injection payloads targeting the plugin's endpoints
Apply the principle of least privilege to the WordPress database user, removing DROP, ALTER, and FILE privileges where feasible
Enable virtual patching through Patchstack or an equivalent WordPress security service

bash

# Temporarily disable the CRM Perks Forms plugin via WP-CLI
wp plugin deactivate crm-perks-forms
wp plugin delete crm-perks-forms