CVE-2024-43978: Super Store Finder SQLi Vulnerability

CVE-2024-43978 Overview

CVE-2024-43978 is a critical SQL Injection vulnerability affecting the Super Store Finder WordPress plugin (superstorefinder-wp) developed by highwarden. This vulnerability allows attackers to exploit improper neutralization of special elements in SQL commands, potentially leading to unauthorized database access, data exfiltration, and complete compromise of the affected WordPress installation.

The vulnerability exists due to insufficient input validation and sanitization in the plugin, enabling unauthenticated attackers to inject malicious SQL queries through network-accessible endpoints. Given the network-based attack vector requiring no authentication or user interaction, this vulnerability poses a significant risk to WordPress sites using the affected plugin versions.

Critical Impact
Unauthenticated SQL Injection allowing complete database compromise, including extraction of sensitive user data, credentials, and potential privilege escalation to full site takeover.

Affected Products

Super Store Finder for WordPress versions prior to 6.9.8
WordPress installations using superstorefinder-wp plugin
Sites with the vulnerable plugin accessible over the network

Discovery Timeline

2024-09-17 - CVE-2024-43978 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-43978

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs when the Super Store Finder plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. The improper neutralization of special characters allows attackers to manipulate database queries, breaking out of the intended query context to execute arbitrary SQL commands.

The vulnerability enables attackers to perform various malicious operations including extracting sensitive data from the WordPress database (such as user credentials, personal information, and site configuration), modifying or deleting database content, and potentially achieving code execution through database features like INTO OUTFILE or stored procedures depending on database configuration.

WordPress plugins that handle store location data often accept user input for search and filtering operations. When this input is directly concatenated into SQL queries without proper parameterization or escaping, it creates an injection point that attackers can exploit.

Root Cause

The root cause is improper input validation and lack of parameterized queries (prepared statements) in the Super Store Finder plugin code. User-controlled input is being directly interpolated into SQL query strings without adequate sanitization, allowing special SQL characters to alter the query structure and logic.

This is a common vulnerability pattern in WordPress plugins where developers use string concatenation to build database queries rather than leveraging WordPress's built-in $wpdb->prepare() function or other parameterized query mechanisms that properly escape user input.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can craft malicious HTTP requests containing SQL injection payloads targeting the vulnerable plugin endpoints.

The exploitation typically involves:

Identifying the vulnerable endpoint in the Super Store Finder plugin
Crafting a malicious request with SQL injection payload (e.g., using UNION-based, error-based, or blind SQL injection techniques)
Extracting database contents including WordPress user credentials
Potentially escalating to full site compromise using extracted administrator credentials

For detailed technical analysis, refer to the Patchstack SQL Injection Advisory.

Detection Methods for CVE-2024-43978

Indicators of Compromise

Unusual database queries in logs containing SQL syntax like UNION SELECT, ' OR 1=1, or hex-encoded payloads
Web server access logs showing requests to Super Store Finder endpoints with suspicious parameters
Database error messages appearing in web application logs or responses
Unexpected changes to WordPress database tables or user accounts
Evidence of data exfiltration or unauthorized admin account creation

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to WordPress plugin endpoints
Monitor database query logs for anomalous queries, particularly those with UNION, SELECT, or comment syntax (--, /**/)
Implement intrusion detection signatures for common SQL injection payloads targeting WordPress installations
Review web server access logs for requests containing encoded special characters or SQL keywords in query parameters

Monitoring Recommendations

Enable verbose logging on the WordPress database server to capture all queries for forensic analysis
Set up alerting for database errors that may indicate injection attempts
Monitor for new user account creation, especially administrator accounts
Implement file integrity monitoring on WordPress core files and plugin directories

How to Mitigate CVE-2024-43978

Immediate Actions Required

Update Super Store Finder plugin to version 6.9.8 or later immediately
Audit database for signs of compromise including unauthorized user accounts or modified content
Review web server logs for evidence of exploitation attempts
Consider temporarily disabling the plugin if immediate patching is not possible
Rotate all WordPress user passwords, especially administrator accounts

Patch Information

The vulnerability has been addressed in Super Store Finder version 6.9.8. WordPress site administrators should update to this version or later through the WordPress admin dashboard or by downloading the patched version from the plugin vendor. After updating, verify the plugin version in the WordPress plugins page to confirm successful installation.

For additional details, consult the Patchstack SQL Injection Advisory.

Workarounds

Implement a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests
Restrict access to WordPress admin areas and plugin endpoints using IP whitelisting where feasible
Temporarily deactivate the Super Store Finder plugin until patching can be completed
Configure database user permissions with least privilege to limit potential damage from SQL injection

bash

# WordPress CLI command to update the plugin
wp plugin update superstorefinder-wp

# Verify plugin version after update
wp plugin list --name=superstorefinder-wp --fields=name,version,update_version