CVE-2024-43942 Overview
CVE-2024-43942 is a SQL Injection vulnerability in the Wpsoul Greenshift Query and Meta Addon plugin for WordPress. The flaw affects all versions prior to 3.9.2 and stems from improper neutralization of special elements used in a SQL command [CWE-89].
Authenticated attackers with subscriber-level privileges can inject SQL statements through unsanitized input passed to the plugin's database query logic. Successful exploitation compromises the confidentiality, integrity, and availability of the WordPress database.
Critical Impact
A low-privileged subscriber account is sufficient to execute arbitrary SQL against the WordPress backend, exposing credentials, user data, and site content.
Affected Products
- Wpsoul Greenshift Query and Meta Addon versions before 3.9.2
- WordPress installations running the vulnerable plugin
- Sites permitting subscriber-level registration alongside the plugin
Discovery Timeline
- 2024-08-29 - CVE-2024-43942 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43942
Vulnerability Analysis
The Greenshift Query and Meta Addon extends the Greenshift WordPress plugin with dynamic query and post meta functionality. The vulnerable code path accepts attacker-controlled parameters and concatenates them into SQL statements executed by the WordPress $wpdb interface without adequate sanitization or prepared statements.
Because the endpoint is reachable by authenticated users at the subscriber role, the exploitation barrier is low. Subscriber accounts can often be self-registered on WordPress sites that allow open user registration, converting an authenticated flaw into a widely reachable one.
The issue is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Refer to the Patchstack SQL Injection Advisory for vendor-coordinated technical details.
Root Cause
The plugin builds SQL query fragments from user-supplied request parameters without applying $wpdb->prepare() or equivalent parameter binding. Special characters such as quotes and comment sequences pass through to the query executor, allowing attackers to alter query structure.
Attack Vector
An authenticated attacker sends a crafted HTTP request to an exposed plugin endpoint. The malicious payload embeds SQL metacharacters and clauses that modify the intended query, permitting data exfiltration through UNION-based reads, boolean-based inference, or time-based blind techniques. No user interaction is required beyond the attacker's authenticated session.
No public proof-of-concept exploit code has been verified. See the Patchstack SQL Injection Advisory for further vendor technical details.
Detection Methods for CVE-2024-43942
Indicators of Compromise
- HTTP requests to Greenshift Query and Meta Addon endpoints containing SQL metacharacters such as UNION, SELECT, --, SLEEP(, or encoded variants.
- Unexpected wp_users or wp_usermeta reads originating from subscriber-role sessions.
- New administrator accounts or password hash modifications following subscriber activity.
- Web server logs showing long, encoded query strings from a single authenticated session.
Detection Strategies
- Deploy a WordPress-aware web application firewall rule set that inspects request parameters for SQL injection signatures against plugin routes.
- Enable MySQL general or slow query logging and alert on queries containing suspicious UNION SELECT patterns tied to plugin execution.
- Correlate authentication events with elevated database activity from low-privileged accounts.
Monitoring Recommendations
- Monitor plugin version inventory across WordPress hosts and flag installations of Greenshift Query and Meta Addon below 3.9.2.
- Audit user registration settings and alert on new subscriber accounts followed by immediate plugin endpoint access.
- Track outbound data volume from web servers to identify bulk extraction consistent with SQLi exfiltration.
How to Mitigate CVE-2024-43942
Immediate Actions Required
- Upgrade Greenshift Query and Meta Addon to version 3.9.2 or later on all WordPress sites.
- Review user accounts and revoke unrecognized subscriber, editor, or administrator entries created before patching.
- Rotate WordPress administrator passwords, database credentials, and secret keys in wp-config.php if compromise is suspected.
- Audit wp_users and wp_options tables for unauthorized modifications.
Patch Information
The vendor addressed the issue in Greenshift Query and Meta Addon version 3.9.2. Update the plugin through the WordPress admin dashboard or via WP-CLI. Confirm the installed version after upgrade and validate that the plugin's query endpoints reject malformed input.
Workarounds
- Temporarily deactivate the Greenshift Query and Meta Addon plugin until the update to 3.9.2 is applied.
- Disable open user registration under Settings → General to eliminate anonymous subscriber creation.
- Restrict access to plugin AJAX and REST endpoints at the web server or WAF layer for unauthenticated and low-privileged sessions.
# Update the plugin via WP-CLI
wp plugin update greenshift-query-and-meta-addon --version=3.9.2
wp plugin list --name=greenshift-query-and-meta-addon --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
