CVE-2024-32087 Overview
CVE-2024-32087 is an authenticated SQL Injection vulnerability [CWE-89] in the ExportFeed.Com Product Feed on WooCommerce for Google plugin for WordPress. The flaw affects all plugin versions up to and including 3.5.7. An authenticated attacker with high privileges can inject malicious SQL through unsanitized inputs, gaining unauthorized read, write, and delete access to the WordPress database. The vulnerability impacts confidentiality, integrity, and availability of the underlying data store.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, enabling data theft, content tampering, and potential site takeover on stores running Product Feed on WooCommerce for Google <= 3.5.7.
Affected Products
- Adtribes Product Feed Pro for WooCommerce (Product Feed on WooCommerce for Google)
- All versions from n/a through 3.5.7
- WordPress deployments using the vulnerable plugin
Discovery Timeline
- 2024-04-15 - CVE-2024-32087 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-32087
Vulnerability Analysis
The vulnerability is a SQL Injection flaw classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The plugin fails to sanitize or parameterize user-supplied input before concatenating it into SQL queries. As a result, attacker-controlled data is executed as SQL by the WordPress database engine.
Exploitation requires authentication with elevated privileges within the WordPress instance. Because the attack vector is network-based and complexity is low, an attacker holding a privileged plugin-management role can reach vulnerable endpoints remotely. Successful exploitation returns full read, write, and delete capability on the database, including access to wp_users password hashes and session tokens.
Root Cause
The root cause is missing input neutralization in one or more request handlers exposed by the plugin. User-controlled parameters are passed directly into $wpdb query strings without using $wpdb->prepare() or equivalent parameter binding. Special SQL characters such as single quotes, comment markers, and UNION keywords are not escaped, allowing attackers to break out of the intended query context.
Attack Vector
An authenticated attacker sends a crafted HTTP request to a plugin endpoint that consumes user input in a SQL query. The malicious payload alters the query logic to extract sensitive rows, modify records, or drop tables. See the Patchstack SQL Injection Advisory for coordinated disclosure details.
No public proof-of-concept exploit code is currently available for CVE-2024-32087. The vulnerability mechanism follows the standard pattern of unsanitized input flowing into a dynamic SQL statement inside the plugin's PHP request handlers.
Detection Methods for CVE-2024-32087
Indicators of Compromise
- Unexpected outbound queries or long-running SQL statements originating from the WordPress wp-admin context.
- Log entries containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in plugin request parameters.
- Unauthorized changes to WordPress user roles, new administrator accounts, or unfamiliar entries in wp_users and wp_usermeta.
- Access log entries targeting Product Feed Pro plugin endpoints from authenticated sessions with abnormal request frequency.
Detection Strategies
- Deploy a web application firewall rule set that inspects POST and GET parameters directed at /wp-admin/admin.php and plugin-specific handlers for SQL injection payloads.
- Enable WordPress debug logging and correlate $wpdb errors with authenticated user activity to catch failed injection attempts.
- Inventory installed plugins and flag any Product Feed Pro for WooCommerce installation with version <= 3.5.7.
Monitoring Recommendations
- Monitor database audit logs for unusual SELECT statements against wp_users, wp_options, and wp_usermeta.
- Alert on privileged WordPress account logins from new IP addresses or geolocations.
- Track file integrity of plugin PHP files and the WordPress uploads directory to detect webshell drops following database compromise.
How to Mitigate CVE-2024-32087
Immediate Actions Required
- Upgrade Product Feed Pro for WooCommerce to a version later than 3.5.7 as soon as a patched release is available from the vendor.
- Audit administrator and shop-manager accounts, rotate passwords, and revoke unused application passwords or API keys.
- Restrict access to /wp-admin/ by IP allowlist where operationally feasible.
- Review database contents for tampering, injected administrative users, or modified plugin options.
Patch Information
Refer to the Patchstack advisory for the current fix status. Upgrade to the latest release published by ExportFeed.Com on the WordPress plugin repository and verify the version reported under Plugins > Installed Plugins is greater than 3.5.7.
Workarounds
- Temporarily deactivate the Product Feed Pro for WooCommerce plugin until a patched version is deployed.
- Enforce least-privilege role assignments so only vetted administrators can access plugin functionality that triggers the vulnerable code path.
- Deploy WAF signatures that block common SQL injection payloads on requests targeting the plugin's admin endpoints.
- Enable two-factor authentication on all high-privileged WordPress accounts to raise the bar for the required authentication precondition.
# Example: block SQLi patterns targeting the plugin endpoints (ModSecurity-style)
SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|benchmark\(|--|;--|/\*!)" \
"id:1032087,phase:2,deny,log,status:403,msg:'CVE-2024-32087 SQLi attempt against Product Feed Pro'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
