CVE-2024-43943 Overview
CVE-2024-43943 is a SQL Injection vulnerability in the Wpsoul Greenshift Woocommerce Addon plugin for WordPress. The flaw affects all plugin versions prior to 1.9.8 and results from improper neutralization of special elements in an SQL command [CWE-89]. Authenticated attackers with low privileges, including Subscriber-level accounts, can inject crafted SQL statements through vulnerable plugin endpoints. Successful exploitation exposes database contents, allows unauthorized modification of records, and can affect service availability on the underlying WooCommerce store.
Critical Impact
A network-reachable attacker holding a low-privilege WordPress account can extract or modify database contents on any WooCommerce site running Greenshift Woocommerce Addon before 1.9.8.
Affected Products
- Wpsoul Greenshift Woocommerce Addon plugin for WordPress
- All versions prior to 1.9.8
- WooCommerce-enabled WordPress sites using the affected plugin
Discovery Timeline
- 2024-08-29 - CVE-2024-43943 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43943
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-supplied input passed to SQL queries within the Greenshift Woocommerce Addon plugin. The plugin concatenates or interpolates request parameters into SQL statements without applying parameterized queries or the WordPress $wpdb->prepare() sanitization layer. An attacker authenticated as a Subscriber-level user, the lowest privileged WordPress role, can submit crafted parameters that alter query logic.
Exploitation grants read access to arbitrary database tables, including the wp_users table containing password hashes and session tokens. Attackers can also write to database records to escalate privileges or plant persistent backdoors. The plugin operates within the WooCommerce context, so exposed data typically includes customer records, order histories, and payment metadata.
Root Cause
The root cause is the direct inclusion of untrusted input in dynamic SQL statements. The affected code paths accept parameters from authenticated users and pass them to database calls without whitelisting, type casting, or prepared statement binding. This violates WordPress secure coding guidance requiring $wpdb->prepare() for any query that includes variable input.
Attack Vector
Exploitation requires network access to the WordPress admin-ajax or REST endpoints exposed by the plugin and a valid low-privilege account. Attacker registration is often permitted on WooCommerce sites offering customer accounts, lowering the barrier to exploitation. The attacker sends HTTP requests containing SQL metacharacters in vulnerable parameters. No user interaction is required.
See the Patchstack advisory for the specific affected parameters and endpoints.
Detection Methods for CVE-2024-43943
Indicators of Compromise
- Unexpected SQL syntax such as UNION SELECT, SLEEP(, information_schema, or comment sequences -- and /* in HTTP request parameters targeting the plugin.
- Anomalous POST or GET requests to wp-admin/admin-ajax.php or plugin REST routes originating from Subscriber-level accounts.
- Unexpected outbound queries against sensitive tables such as wp_users or wp_usermeta.
- New administrator accounts or modified user_pass entries in wp_users without a corresponding legitimate workflow.
Detection Strategies
- Enable WordPress query logging or a database audit plugin to capture queries generated by low-privilege sessions.
- Deploy a Web Application Firewall (WAF) rule set that flags SQL injection payloads directed at Greenshift plugin endpoints.
- Correlate authentication events for Subscriber accounts with unusual database access volume.
Monitoring Recommendations
- Alert on HTTP requests to plugin endpoints containing SQL metacharacters or encoded variants (%27, %22, 0x).
- Monitor for privilege changes and new administrator role assignments in the WordPress database.
- Track error responses from the database layer, which often indicate injection probing.
How to Mitigate CVE-2024-43943
Immediate Actions Required
- Update Greenshift Woocommerce Addon to version 1.9.8 or later on all affected WordPress installations.
- Audit wp_users and wp_usermeta for unauthorized accounts or role changes since deployment of the plugin.
- Rotate WordPress administrator credentials and force password resets for any accounts with elevated privileges.
- Review recent Subscriber-level registrations and revoke suspicious accounts.
Patch Information
The vendor released a fix in Greenshift Woocommerce Addon version 1.9.8. Refer to the Patchstack vulnerability record for advisory details and update guidance.
Workarounds
- Disable the Greenshift Woocommerce Addon plugin until the update to 1.9.8 or later can be applied.
- Restrict new user registration on the WooCommerce site to reduce the pool of low-privilege attackers.
- Deploy a WAF rule blocking SQL injection payloads against plugin endpoints as a compensating control.
# Configuration example
# Update the plugin via WP-CLI on the WordPress host
wp plugin update greenshift-woocommerce-addon --version=1.9.8
wp plugin list --name=greenshift-woocommerce-addon --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
