CVE-2024-32127: Find Duplicates SQL Injection Flaw

CVE-2024-32127 Overview

CVE-2024-32127 is a SQL Injection vulnerability affecting the Markus Seyer Find Duplicates plugin for WordPress. The flaw exists in all versions up to and including 1.4.6. An authenticated attacker with subscriber-level privileges can inject arbitrary SQL statements through unsanitized input passed to database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database. The vulnerability is tracked under CWE-89 and stems from improper neutralization of special elements in an SQL command.

Critical Impact
Authenticated attackers with low privileges can execute arbitrary SQL queries, extract sensitive data, escalate privileges, or manipulate WordPress content stored in the database.

Affected Products

Markus Seyer Find Duplicates plugin for WordPress
All versions from n/a through 1.4.6
WordPress sites running the vulnerable plugin with subscriber registration enabled

Discovery Timeline

2024-04-15 - CVE-2024-32127 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32127

Vulnerability Analysis

The Find Duplicates plugin fails to properly sanitize user-supplied input before including it in SQL queries executed against the WordPress database. This omission allows attackers to break out of the intended query context and append arbitrary SQL commands. The vulnerability requires authentication, but the required privilege level is subscriber, which is available on any WordPress site permitting user registration.

Exploitation occurs over the network without user interaction. An attacker who authenticates with a low-privileged account can reach the vulnerable code path through standard plugin endpoints. The resulting query manipulation grants full read and write access to the WordPress database, including the wp_users and wp_options tables.

The EPSS score of 0.577% indicates the vulnerability has not yet attracted widespread automated exploitation. However, WordPress plugin SQL injection flaws are routinely weaponized once public advisories circulate.

Root Cause

The root cause is the direct concatenation of untrusted input into SQL statements without parameterization or escaping. The plugin does not apply $wpdb->prepare() or equivalent sanitization functions such as esc_sql() before passing values to the database layer. This design flaw maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An authenticated subscriber sends a crafted HTTP request to a vulnerable plugin endpoint. The request contains SQL metacharacters and injected clauses within a parameter that the plugin passes to the database. The injected payload executes with the privileges of the WordPress database user, typically full read and write access to all site tables.

The vulnerability mechanism involves unsanitized parameter values being embedded directly into SELECT, UPDATE, or DELETE statements. Attackers commonly leverage UNION-based extraction to retrieve password hashes, session tokens, and secret keys. See the Patchstack Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2024-32127

Indicators of Compromise

Unexpected admin_ajax.php or plugin-specific requests originating from subscriber accounts containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
New administrator accounts appearing in wp_users without a corresponding audit trail
Modifications to the wp_options table entries siteurl, home, or active_plugins without administrator activity
Unusual outbound connections from the WordPress host following subscriber authentication events

Detection Strategies

Monitor web server access logs for query strings containing SQL metacharacters directed at Find Duplicates plugin endpoints
Enable WordPress database query logging and alert on queries containing conditional payloads such as OR 1=1 or time-based functions like BENCHMARK and SLEEP
Deploy a Web Application Firewall rule set that flags SQL injection patterns targeting /wp-admin/admin-ajax.php and plugin routes
Correlate subscriber-role authentication events with subsequent database write activity

Monitoring Recommendations

Ingest WordPress access logs, PHP error logs, and MySQL general query logs into a centralized analytics platform for correlation
Track plugin version inventory across all WordPress instances and flag installations at or below version 1.4.6
Alert on privilege escalation events, particularly changes to the wp_usermetawp_capabilities field
Baseline expected query volume per authenticated role and alert on deviations from subscriber accounts

How to Mitigate CVE-2024-32127

Immediate Actions Required

Identify all WordPress instances running Find Duplicates version 1.4.6 or earlier and prioritize them for remediation
Disable or uninstall the Find Duplicates plugin until a patched version is available and verified
Disable open user registration on affected WordPress sites to eliminate the subscriber-level prerequisite
Rotate WordPress secret keys, administrator credentials, and any API tokens stored in the database after removing the plugin

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. The advisory indicates the issue affects the plugin from an unspecified initial version through 1.4.6. Administrators should consult the Patchstack Vulnerability Advisory for the latest patch status and upgrade to any released fixed version once available.

Workarounds

Remove the Find Duplicates plugin entirely from production WordPress installations until a vendor patch is confirmed
Restrict access to plugin endpoints using web server access control lists limited to trusted administrator IP addresses
Deploy a virtual patch through a Web Application Firewall to block SQL injection payloads targeting the plugin's request parameters
Enforce least-privilege on the WordPress database user by removing DROP, ALTER, and FILE privileges where feasible

bash

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate find-duplicates
wp plugin delete find-duplicates

# Verify removal
wp plugin list | grep find-duplicates