CVE-2024-30504: WP Travel Engine SQL Injection Flaw

CVE-2024-30504 Overview

CVE-2024-30504 is an SQL injection vulnerability in the WP Travel Engine plugin for WordPress. The flaw affects all versions up to and including 5.7.9. The vulnerability results from improper neutralization of special elements used in an SQL command [CWE-89]. Authenticated attackers with high privileges can inject malicious SQL statements through vulnerable input parameters. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying database.

Critical Impact
An authenticated attacker with high privileges can execute arbitrary SQL queries against the WordPress database, enabling data theft, modification, or destruction across the entire site.

Affected Products

WP Travel Engine plugin for WordPress versions up to and including 5.7.9
WordPress sites running the WP Travel Engine booking system
Any WordPress deployment with the vulnerable plugin activated

Discovery Timeline

2024-03-29 - CVE-2024-30504 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30504

Vulnerability Analysis

The WP Travel Engine plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. This weakness maps to [CWE-89], Improper Neutralization of Special Elements used in an SQL Command. Attackers who possess high-privilege authenticated access can manipulate query parameters to alter the intended SQL statement structure.

The vulnerability affects the plugin's database interaction layer through version 5.7.9. Exploitation occurs over the network without user interaction. Successful attacks give the adversary the ability to read arbitrary database contents, modify records, or delete data stored by WordPress and other installed plugins.

Root Cause

The root cause is missing or insufficient input validation and parameterization in SQL queries constructed by the plugin. When user-controlled values reach query-building functions without proper escaping or prepared statement usage, the database engine interprets injected syntax as executable SQL. This design pattern violates secure coding practices for WordPress plugins, which should use $wpdb->prepare() for all dynamic query construction.

Attack Vector

An attacker requires authenticated access with high privileges to reach the vulnerable code path. Once authenticated, the attacker sends crafted HTTP requests containing SQL metacharacters to the vulnerable plugin endpoint. The injected payload alters query logic to extract sensitive data such as user credentials, session tokens, and personally identifiable information from bookings. Refer to the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2024-30504

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, OR 1=1, or SLEEP() in HTTP request parameters targeting WP Travel Engine endpoints
Anomalous database queries originating from the WordPress plugin containing concatenated user input
Unauthorized data exfiltration patterns in web server access logs for /wp-admin/ requests referencing WP Travel Engine
Sudden spikes in database read operations from authenticated administrator sessions

Detection Strategies

Deploy web application firewall rules that inspect POST and GET parameters submitted to WP Travel Engine endpoints for SQL metacharacters
Enable MySQL general query logging and alert on queries containing suspicious patterns tied to plugin functions
Correlate WordPress authentication events with subsequent database activity to identify abuse of high-privilege sessions

Monitoring Recommendations

Monitor plugin version inventory across WordPress deployments and flag installations at or below version 5.7.9
Track authenticated administrator activity for unusual query volumes or off-hours access
Alert on HTTP 500 responses from plugin endpoints, which often accompany failed injection attempts

How to Mitigate CVE-2024-30504

Immediate Actions Required

Update WP Travel Engine to a version later than 5.7.9 as soon as the vendor releases a patched build
Audit all WordPress administrator and editor accounts and remove unnecessary high-privilege access
Rotate WordPress database credentials and administrator passwords if compromise is suspected
Review database contents for unauthorized modifications to bookings, users, and options tables

Patch Information

The Patchstack advisory identifies the vulnerable range as up to and including 5.7.9. Administrators should consult the Patchstack SQL Injection Advisory and the official WP Travel Engine plugin repository for the latest fixed release. Apply updates through the WordPress plugin manager or a controlled staging-to-production workflow.

Workarounds

Deactivate the WP Travel Engine plugin until a patched version is available if the booking functionality is not business-critical
Restrict access to the WordPress admin interface using IP allowlists or VPN-only access to limit exposure of the authenticated attack surface
Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin endpoints
Enforce the principle of least privilege by demoting users who do not require administrator or editor roles

bash

# Example: restrict wp-admin access via .htaccess IP allowlist
<Files wp-login.php>
  Require ip 203.0.113.0/24
</Files>
<Directory /var/www/html/wp-admin>
  Require ip 203.0.113.0/24
</Directory>