CVE-2024-3217 Overview
CVE-2024-3217 is a SQL Injection vulnerability [CWE-89] affecting the WP Directory Kit plugin for WordPress. The flaw exists in all versions up to and including 1.3.0. Insufficient escaping of the attribute_value and attribute_id parameters, combined with inadequate query preparation, allows authenticated attackers to inject SQL statements. Attackers with subscriber-level access or higher can append arbitrary SQL queries to existing database calls. Exploitation enables extraction of sensitive information from the WordPress database, including user credentials and session data.
Critical Impact
Authenticated attackers with subscriber-level privileges can execute arbitrary SQL queries and exfiltrate sensitive database contents from affected WordPress sites.
Affected Products
- WP Directory Kit plugin for WordPress, all versions up to and including 1.3.0
- WordPress installations using the wpdirectorykit plugin with subscriber-or-higher account provisioning
- Sites exposing the Wdk_frontendajax controller endpoints
Discovery Timeline
- 2024-04-05 - CVE-2024-3217 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-3217
Vulnerability Analysis
The vulnerability resides in the Wdk_frontendajax.php controller of the WP Directory Kit plugin. The affected code path constructs SQL queries using the attribute_value and attribute_id parameters supplied by the requester. The plugin fails to properly escape these inputs and does not use parameterized queries or prepared statements. Authenticated users, including low-privilege subscribers, can send crafted AJAX requests to the plugin endpoint. The injected SQL is concatenated into the query and executed by the underlying database engine.
The attack requires only network access and valid authentication, with no user interaction. Because WordPress subscriber accounts are frequently self-registered on public sites, the authentication barrier offers minimal protection.
Root Cause
The root cause is a failure to apply WordPress's $wpdb->prepare() API to user-controlled query fragments. The plugin passes the attribute_value and attribute_id values directly into a SQL string without sanitization or type casting. Reference the WordPress Plugin Source Code at line 72 for the vulnerable construction.
Attack Vector
An authenticated attacker submits an AJAX POST request to the plugin's front-end endpoint with a malicious payload in attribute_value or attribute_id. Union-based or boolean-based SQL Injection techniques can extract data from the wp_users and wp_usermeta tables. This includes password hashes and session tokens, enabling account takeover of higher-privileged users. See the Wordfence Vulnerability Report for additional exploitation context.
Detection Methods for CVE-2024-3217
Indicators of Compromise
- POST requests to admin-ajax.php referencing the wpdirectorykit action handler containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the attribute_value or attribute_id parameters
- Unusual response times or HTTP 500 responses from the Wdk_frontendajax controller consistent with time-based blind SQL Injection
- New or modified WordPress administrator accounts appearing after subscriber authentication activity
- Outbound queries or dumps referencing wp_users, wp_usermeta, or wp_options from the WordPress database process
Detection Strategies
- Deploy WordPress-aware Web Application Firewall (WAF) signatures that inspect AJAX parameters for SQL metacharacters and control keywords
- Enable WordPress debug logging and MySQL general query logging to correlate authenticated sessions with anomalous query patterns
- Alert on any request from a subscriber-level session that triggers database errors returned by the WP Directory Kit endpoint
Monitoring Recommendations
- Monitor authentication logs for newly registered subscriber accounts that immediately interact with plugin AJAX endpoints
- Track query volume and syntax anomalies against tables containing credentials and secrets
- Review WordPress plugin inventory continuously to confirm the installed version of WP Directory Kit is above 1.3.0
How to Mitigate CVE-2024-3217
Immediate Actions Required
- Update the WP Directory Kit plugin to a version later than 1.3.0 that includes the fix committed in changeset 3064842
- Audit WordPress user accounts and revoke unnecessary subscriber-level registrations from untrusted sources
- Rotate WordPress administrator passwords and secret keys defined in wp-config.php if exploitation is suspected
- Review database contents for unauthorized modifications to the wp_users and wp_options tables
Patch Information
The vendor released a patch in the WordPress plugin repository via changeset 3064842. The fix modifies Wdk_frontendajax.php to properly prepare and escape the attribute_value and attribute_id parameters before use in SQL queries. Site administrators should upgrade to the latest available version through the WordPress admin dashboard or via WP-CLI.
Workarounds
- Deactivate and remove the WP Directory Kit plugin until the update can be applied
- Restrict access to wp-admin/admin-ajax.php for the vulnerable action handler via WAF rules or .htaccess filters
- Disable open user registration in WordPress settings to reduce the pool of authenticated attackers
# Update WP Directory Kit using WP-CLI
wp plugin update wpdirectorykit --version=latest
# Verify installed version is above 1.3.0
wp plugin get wpdirectorykit --field=version
# Disable open registration to reduce attack surface
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
