CVE-2024-43145 Overview
CVE-2024-43145 is a SQL Injection vulnerability affecting the AyeCode Ltd GeoDirectory plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. All GeoDirectory versions up to and including 2.3.61 are affected. An authenticated attacker with low privileges can inject arbitrary SQL statements over the network without user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the underlying WordPress database.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, enabling data theft, content manipulation, and potential full site compromise.
Affected Products
- AyeCode Ltd GeoDirectory WordPress plugin versions up to and including 2.3.61
- WordPress sites running the vulnerable GeoDirectory plugin
- Any web application stack integrated with the vulnerable plugin version
Discovery Timeline
- 2024-08-18 - CVE-2024-43145 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43145
Vulnerability Analysis
The vulnerability resides in the GeoDirectory plugin, a WordPress directory listing plugin developed by AyeCode Ltd. User-supplied input reaches an SQL query without proper sanitization or parameterization. An attacker holding valid low-privileged credentials can send crafted requests that alter the intended SQL statement. This gives the attacker direct read and write access to WordPress database tables, including wp_users and wp_options. The impact extends to full database compromise, credential theft, and manipulation of stored content served to site visitors.
Root Cause
The root cause is improper neutralization of special elements passed into an SQL query [CWE-89]. The affected code path concatenates request parameters into a SQL statement instead of using prepared statements or the WordPress $wpdb->prepare() API. Special characters such as single quotes, comment markers, and UNION keywords are interpreted as SQL syntax rather than data.
Attack Vector
Exploitation requires network access to the WordPress site and authentication as a low-privileged user. The attacker submits an HTTP request containing a malicious payload in a parameter processed by GeoDirectory. The plugin passes the tainted value into a database query, executing the injected SQL. No user interaction from a victim is required. See the Patchstack SQL Injection Advisory for additional technical context.
No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism follows the standard SQL injection pattern: attacker-controlled input is concatenated into a query, breaking out of the intended data context and executing attacker-supplied SQL clauses.
Detection Methods for CVE-2024-43145
Indicators of Compromise
- HTTP requests to GeoDirectory endpoints containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP(
- Unexpected wp_users modifications, new administrator accounts, or altered wp_options values
- Database error messages appearing in web server logs referencing GeoDirectory queries
- Anomalous outbound traffic from the WordPress host following authenticated sessions
Detection Strategies
- Review WordPress access logs for authenticated requests to GeoDirectory endpoints containing SQL syntax patterns in query parameters or POST bodies
- Enable MySQL general query logging on a staging replica to inspect queries generated by GeoDirectory for anomalous structure
- Deploy web application firewall rules that flag common SQL injection payloads targeting /wp-admin/ and plugin AJAX endpoints
Monitoring Recommendations
- Alert on privilege changes and new user creation events in wp_users and wp_usermeta
- Monitor for unusual query volume or execution time from the WordPress database user
- Correlate authentication events with subsequent GeoDirectory requests to identify credential misuse
How to Mitigate CVE-2024-43145
Immediate Actions Required
- Upgrade GeoDirectory to a version later than 2.3.61 as published by AyeCode Ltd
- Audit WordPress user accounts and revoke unnecessary contributor, author, or subscriber roles
- Rotate database credentials and administrator passwords if compromise is suspected
- Review the Patchstack advisory for vendor guidance
Patch Information
AyeCode Ltd has released a fixed version addressing this SQL injection. Administrators should update GeoDirectory through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Verify the installed version reports higher than 2.3.61 after the update.
Workarounds
- Deactivate the GeoDirectory plugin until the patched version can be deployed
- Restrict access to authenticated WordPress endpoints using IP allowlisting at the web server or WAF layer
- Apply virtual patching rules in a WAF to block SQL injection payloads targeting GeoDirectory routes
- Enforce least privilege on the WordPress database user by removing DROP, ALTER, and FILE permissions where feasible
# Verify installed GeoDirectory version and update via WP-CLI
wp plugin get geodirectory --field=version
wp plugin update geodirectory
wp plugin get geodirectory --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
