CVE-2024-3067 Overview
CVE-2024-3067 is a SQL Injection vulnerability affecting the WooCommerce Google Feed Manager plugin for WordPress. The flaw exists in all versions up to and including 2.4.2. It stems from insufficient escaping on the user-supplied id parameter combined with a lack of sufficient preparation on the underlying SQL query. Authenticated attackers with administrator-level access can append additional SQL queries to existing queries and extract sensitive data from the WordPress database. Unauthenticated attackers can also leverage the same weakness to inject malicious web scripts. The issue is tracked under CWE-89.
Critical Impact
Attackers can extract sensitive database contents including user credentials, session tokens, and WooCommerce customer data through crafted id parameter values.
Affected Products
- WooCommerce Google Feed Manager plugin (wp-product-feed-manager) versions up to and including 2.4.2
- WordPress sites running the WPMarketingRobot plugin distribution
- WooCommerce stores relying on the plugin for Google product feeds
Discovery Timeline
- 2024-04-16 - CVE-2024-3067 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3067
Vulnerability Analysis
The vulnerability resides in the feed editor page component of the plugin, specifically in class-wppfm-feed-editor-page.php. The id parameter, provided through user input, flows into a SQL query without proper escaping or prepared statement usage. This allows attackers to append arbitrary SQL clauses to the existing query. Authenticated administrators can use this to run UNION-based extraction against WordPress tables such as wp_users and wp_usermeta. The advisory also notes that the same input path enables unauthenticated attackers to inject malicious web scripts, extending impact beyond data exfiltration into client-side attacks against site visitors and administrators.
Root Cause
The root cause is the absence of $wpdb->prepare() usage and missing sanitization on the id parameter before it is concatenated into a SQL statement. The plugin trusts request data and passes it directly into a query string, violating WordPress database API best practices for parameterized queries.
Attack Vector
The attack vector is network-based through crafted HTTP requests to the plugin's feed editor endpoint. An authenticated attacker with administrator privileges submits a malicious id parameter value containing SQL syntax. The payload is concatenated into the vulnerable query and executed against the database. See the WordPress Plugin Code Review and the Wordfence Vulnerability Analysis for technical specifics.
Detection Methods for CVE-2024-3067
Indicators of Compromise
- HTTP requests to plugin endpoints containing SQL metacharacters such as ', UNION SELECT, --, or /* in the id parameter
- Unexpected outbound queries or database errors logged by WordPress or the MySQL server referencing wp-product-feed-manager pages
- New or modified administrator accounts in wp_users following requests to the feed editor page
- Injected <script> tags observed in stored plugin content or served responses
Detection Strategies
- Review web server access logs for suspicious query strings targeting admin.php?page=wppfm-* with encoded SQL payloads in id
- Enable MySQL general query or slow query logs to capture queries containing malformed id values
- Deploy a WordPress-aware Web Application Firewall (WAF) rule that blocks SQL syntax in the id parameter of plugin requests
Monitoring Recommendations
- Monitor authenticated administrator sessions for anomalous access to plugin configuration pages
- Alert on WordPress wp_users or wp_options table changes correlated with plugin activity
- Track plugin version inventory across managed WordPress sites and flag installations at or below version 2.4.2
How to Mitigate CVE-2024-3067
Immediate Actions Required
- Update the WooCommerce Google Feed Manager plugin to a version above 2.4.2 as soon as a fixed release is available from the vendor
- Audit WordPress administrator accounts and rotate credentials for any account that had access during the exposure window
- Restrict administrative access to the WordPress dashboard using IP allowlisting or multi-factor authentication
Patch Information
The vendor released a fix referenced in the WordPress Plugin Changeset. Administrators should apply plugin updates through the WordPress dashboard or via WP-CLI using wp plugin update wp-product-feed-manager.
Workarounds
- Deactivate the WooCommerce Google Feed Manager plugin until it can be updated to a patched version
- Deploy a WAF rule that rejects requests containing SQL syntax in the id parameter to plugin endpoints
- Reduce the number of accounts holding administrator privileges to limit the population capable of authenticated exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
