CVE-2024-32125 Overview
CVE-2024-32125 is a SQL injection vulnerability in the Booking Algorithms BA Book Everything WordPress plugin. The flaw affects all versions up to and including 1.6.4. It stems from improper neutralization of special elements used in SQL commands [CWE-89]. An authenticated attacker with low privileges can inject arbitrary SQL statements through the plugin over the network. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, enabling data theft, modification, and full site compromise.
Affected Products
- Booking Algorithms BA Book Everything WordPress plugin versions through 1.6.4
- WordPress sites with the plugin installed and active
- Any hosted environment exposing the vulnerable plugin endpoints to authenticated users
Discovery Timeline
- 2024-04-15 - CVE-2024-32125 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-32125
Vulnerability Analysis
The vulnerability resides in the BA Book Everything plugin's handling of user-controlled input before it reaches SQL query construction. The plugin fails to properly sanitize or parameterize input passed to database queries. An attacker with at least low-privileged authenticated access can supply crafted parameters containing SQL metacharacters. These characters break out of the intended query context and append attacker-controlled SQL clauses.
Because the attack vector is network-based and requires only low-complexity interaction, exploitation is straightforward once authenticated access exists. The Exploit Prediction Scoring System rates the probability at 0.577% (44th percentile), reflecting a moderate likelihood of exploitation activity. No public proof-of-concept or CISA KEV listing has been recorded at the time of writing.
Root Cause
The root cause is the direct concatenation of untrusted input into SQL statements without the use of prepared statements or WordPress's $wpdb->prepare() API. Missing input validation and output encoding allow special SQL characters such as single quotes, semicolons, and comment markers to alter query semantics.
Attack Vector
An attacker authenticates to WordPress with a low-privilege account, such as a subscriber or customer role permitted by the plugin. The attacker then submits crafted parameters to plugin endpoints that reach vulnerable query paths. Injected payloads can extract data through UNION-based queries, exfiltrate rows via blind boolean or time-based techniques, or modify records to achieve privilege escalation within the WordPress instance.
Detailed advisory information is available in the Patchstack SQL Injection Vulnerability entry.
Detection Methods for CVE-2024-32125
Indicators of Compromise
- Web server access logs showing SQL metacharacters (', --, UNION, SLEEP(, information_schema) in parameters targeting BA Book Everything endpoints
- Unusual database queries originating from the WordPress plugin, including queries against wp_users or wp_options tables
- New or modified administrator accounts in wp_users not tied to legitimate administrative activity
- Elevated response times on booking-related requests, consistent with time-based blind SQL injection
Detection Strategies
- Inspect HTTP request logs for anomalous query strings and POST bodies sent to plugin URLs under /wp-admin/admin-ajax.php or plugin-specific routes
- Enable WordPress database query logging and alert on queries containing operators such as UNION SELECT, BENCHMARK, or nested subqueries from plugin contexts
- Deploy web application firewall (WAF) rules that flag SQL injection payloads on authenticated plugin endpoints
Monitoring Recommendations
- Monitor authentication events for low-privilege accounts making repeated requests to booking endpoints
- Track outbound data volumes from the WordPress host for signs of database exfiltration
- Correlate WordPress audit events with database server logs to detect unauthorized SELECT, UPDATE, or INSERT activity
How to Mitigate CVE-2024-32125
Immediate Actions Required
- Update the BA Book Everything plugin to a version later than 1.6.4 as soon as a patched release is available from the vendor
- Audit all WordPress user accounts and revoke unnecessary low-privilege access to the affected site
- Review the wp_users, wp_usermeta, and booking-related tables for unauthorized modifications
Patch Information
Refer to the Patchstack SQL Injection Vulnerability advisory for the most current fixed version and vendor guidance. Apply the patched plugin release through the WordPress admin dashboard or by replacing the plugin files directly.
Workarounds
- Deactivate and remove the BA Book Everything plugin until a patched version can be installed
- Restrict access to WordPress registration and low-privilege authentication to trusted users only
- Place a WAF in front of the WordPress site with SQL injection signatures enabled for plugin URLs
- Enforce least-privilege database credentials for the WordPress database user to limit the impact of injected queries
# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate ba-book-everything
wp plugin delete ba-book-everything
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
