CVE-2024-37090: Consulting Elementor Widgets SQLi Flaw

CVE-2024-37090 Overview

CVE-2024-37090 is a SQL Injection vulnerability affecting two WordPress plugins developed by StylemixThemes: Masterstudy Elementor Widgets and Consulting Elementor Widgets. The flaw arises from improper neutralization of special elements used in SQL commands [CWE-89]. Authenticated attackers with low privileges can inject arbitrary SQL statements against the underlying WordPress database. The vulnerability affects Masterstudy Elementor Widgets versions up to and including 1.2.2, and Consulting Elementor Widgets versions up to and including 1.3.0. Successful exploitation exposes site data, credentials, and configuration values stored in the database.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries, leading to disclosure of sensitive database contents, modification of records, and full compromise of confidentiality, integrity, and availability.

Affected Products

StylemixThemes Masterstudy Elementor Widgets (WordPress plugin) versions up to and including 1.2.2
StylemixThemes Consulting Elementor Widgets (WordPress plugin) versions up to and including 1.3.0
WordPress sites running either plugin alongside Elementor

Discovery Timeline

2024-07-09 - CVE-2024-37090 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37090

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw [CWE-89] within two StylemixThemes Elementor widget plugins. Both plugins fail to properly sanitize or parameterize user-supplied input before including it in SQL statements executed against the WordPress database. An authenticated attacker with low privileges can supply crafted input to a vulnerable endpoint. The injected SQL is then executed with the database privileges of the WordPress application user. Because WordPress typically grants its database user broad read and write permissions on the site database, exploitation can affect confidentiality, integrity, and availability of the entire site.

Root Cause

The root cause is missing input validation and the absence of prepared statements or $wpdb->prepare() usage when constructing SQL queries in plugin request handlers. User-controlled parameters are concatenated directly into query strings, allowing attackers to break out of the intended query context and append arbitrary SQL clauses.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker must hold an authenticated account with at least low-level privileges on the WordPress instance. Once authenticated, the attacker submits crafted parameters to the vulnerable plugin endpoints. No user interaction is required. Refer to the Patchstack advisory for Masterstudy Elementor Widgets and the Patchstack advisory for Consulting Elementor Widgets for endpoint specifics.

Detection Methods for CVE-2024-37090

Indicators of Compromise

Unexpected SQL syntax characters such as ', ", UNION, SELECT, OR 1=1, or SLEEP( in POST/GET parameters targeting Elementor widget AJAX endpoints.
WordPress database logs showing queries containing untypical UNION SELECT statements or references to wp_users and wp_options originating from plugin handlers.
Web server access logs recording authenticated low-privilege sessions accessing plugin endpoints repeatedly with varying query parameters.

Detection Strategies

Deploy a Web Application Firewall (WAF) with signatures for SQL injection targeting WordPress plugin endpoints, and enable virtual patching from vendors like Patchstack or Wordfence.
Enable MySQL/MariaDB general query logging or slow query logging on WordPress databases and alert on anomalous query patterns from PHP-FPM processes.
Correlate WordPress authentication events with plugin AJAX endpoint calls to identify low-privilege accounts probing widget parameters.

Monitoring Recommendations

Monitor outbound database queries from the WordPress application for statements referencing sensitive tables outside normal plugin behavior.
Track HTTP 500 errors and unusual response sizes from Masterstudy and Consulting widget endpoints, which can indicate injection attempts.
Alert on new administrator accounts, unexpected wp_users modifications, or option table changes following authenticated plugin activity.

How to Mitigate CVE-2024-37090

Immediate Actions Required

Update Masterstudy Elementor Widgets to a version later than 1.2.2 and Consulting Elementor Widgets to a version later than 1.3.0.
Audit all WordPress user accounts, remove unnecessary low-privilege accounts, and enforce strong authentication with multi-factor authentication.
Review WordPress and database logs for signs of prior exploitation, focusing on requests to the affected plugin endpoints.

Patch Information

StylemixThemes has issued fixed releases addressing the SQL injection. Administrators should install the latest available versions of both plugins from the WordPress plugin repository. Consult the Patchstack Masterstudy advisory and the Patchstack Consulting advisory for fixed version details.

Workarounds

Temporarily deactivate the Masterstudy Elementor Widgets and Consulting Elementor Widgets plugins until patched versions are deployed.
Restrict access to /wp-admin/ and plugin AJAX endpoints via IP allowlisting or authentication proxies while remediation is pending.
Apply WAF rules that block common SQL injection payloads targeting Elementor plugin parameters as a compensating control.

bash

# Configuration example: WP-CLI plugin update and audit
wp plugin update masterstudy-elementor-widgets
wp plugin update consulting-elementor-widgets
wp plugin list --status=active --field=name,version
wp user list --role=subscriber --fields=ID,user_login,user_registered