CVE-2024-43917: TI WooCommerce Wishlist SQLi Vulnerability

CVE-2024-43917 Overview

CVE-2024-43917 is a SQL injection vulnerability affecting the TemplateInvaders TI WooCommerce Wishlist plugin for WordPress. The flaw exists in all versions up to and including 2.8.2. Attackers can inject malicious SQL statements through unsanitized input parameters, gaining unauthorized access to the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Exploitation requires no authentication and no user interaction, making any WordPress site running the affected plugin a viable target.

Critical Impact

Unauthenticated remote attackers can extract, modify, or delete database contents on any WordPress site running TI WooCommerce Wishlist 2.8.2 or earlier, including customer records, credentials, and order data.

Affected Products

• TemplateInvaders TI WooCommerce Wishlist plugin versions through 2.8.2
• WordPress sites running the free WordPress.org distribution of the plugin
• WooCommerce stores integrating the wishlist functionality

Discovery Timeline

• 2024-08-29 - CVE CVE-2024-43917 published to NVD
• 2024-09-19 - Last updated in NVD database

Technical Details for CVE-2024-43917

Vulnerability Analysis

The vulnerability stems from improper neutralization of special characters used in SQL commands within the TI WooCommerce Wishlist plugin. User-controlled input flows into SQL query construction without parameterization or proper escaping through WordPress's $wpdb->prepare() function. Attackers can break out of the intended query context and append arbitrary SQL clauses.

The attack surface is reachable over the network without authentication or user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the underlying WordPress database. Given that WordPress stores password hashes, session tokens, and personal data in MySQL, exploitation can lead to full site takeover.

The EPSS probability is 90.032% at the 99.593 percentile, indicating active exploitation interest across the threat landscape. Refer to the Patchstack advisory for technical specifics.

Root Cause

The plugin concatenates user-supplied request parameters directly into SQL query strings. The WordPress database abstraction layer offers $wpdb->prepare() for safe parameter binding, but the affected code paths bypass this protection. The result is classic in-band SQL injection where attacker payloads alter query semantics.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests containing SQL metacharacters to plugin endpoints handling wishlist operations. The payload manipulates the underlying query to perform UNION-based extraction, boolean-based blind inference, or time-based blind injection. Successful queries return sensitive data such as administrator password hashes from wp_users or session data from wp_usermeta.

The vulnerability mechanism follows the typical WordPress SQL injection pattern where request parameters are interpolated into queries against tables like wp_tinvwl_lists without %s or %d placeholders. See the Patchstack advisory for additional context.

Detection Methods for CVE-2024-43917

Indicators of Compromise

• HTTP requests to wishlist-related endpoints containing SQL keywords such as UNION SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA
• Unusually long response times on wishlist endpoints, suggesting time-based blind injection
• MySQL error log entries referencing malformed queries originating from plugin request handlers
• Unexpected administrator account creation or modifications to wp_users and wp_options tables
• Outbound traffic from the web server to attacker infrastructure following anomalous database activity

Detection Strategies

• Deploy a Web Application Firewall (WAF) ruleset that flags SQL metacharacters in wishlist plugin request parameters
• Enable MySQL general query logging and alert on queries containing tautologies like OR 1=1 or stacked statements
• Inspect WordPress access logs for repeated requests to wishlist endpoints with encoded payloads such as %27 or 0x
• Correlate authentication anomalies with preceding requests to plugin endpoints

Monitoring Recommendations

• Forward web server, PHP, and MySQL logs to a centralized analytics platform for correlation
• Monitor file integrity on wp-content/plugins/ti-woocommerce-wishlist/ to identify tampering after exploitation
• Track creation of new privileged WordPress users and changes to wp_options containing siteurl or home

How to Mitigate CVE-2024-43917

Immediate Actions Required

• Update the TI WooCommerce Wishlist plugin to a version newer than 2.8.2 as soon as a fixed release is available from the vendor
• Audit wp_users, wp_options, and plugin-specific tables for unauthorized modifications since deploying the affected plugin
• Rotate all WordPress administrator passwords and invalidate active sessions if exploitation is suspected
• Restrict database user permissions so the WordPress MySQL account cannot execute FILE or schema-altering operations

Patch Information

Review the Patchstack vulnerability database entry for the latest patched version and apply the update through the WordPress plugin manager. Verify the installed version reports higher than 2.8.2 after the update.

Workarounds

• Deactivate and remove the TI WooCommerce Wishlist plugin until a patched version is installed
• Place WAF rules in front of the WordPress site that block requests containing SQL injection signatures targeting wishlist endpoints
• Restrict access to the plugin's AJAX and REST endpoints by IP allowlist where feasible
• Apply virtual patching via WAF managed rules from Patchstack or similar WordPress-focused providers

# Disable the vulnerable plugin via WP-CLI until a patched version is installed
wp plugin deactivate ti-woocommerce-wishlist
wp plugin delete ti-woocommerce-wishlist

# Verify removal
wp plugin list | grep ti-woocommerce-wishlist