CVE-2024-4443: Business Directory Plugin SQLi Vulnerability

CVE-2024-4443 Overview

CVE-2024-4443 is a time-based SQL injection vulnerability in the Business Directory Plugin – Easy Listing Directories for WordPress. The flaw exists in all versions up to and including 6.4.2 and stems from insufficient escaping of the listingfields parameter combined with inadequate query preparation. Unauthenticated attackers can append additional SQL queries to existing database queries and extract sensitive information. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials and personally identifiable information, through time-based SQL injection.

Affected Products

Business Directory Plugin – Easy Listing Directories for WordPress, all versions up to and including 6.4.2
WordPress sites running the businessdirectoryplugin/business_directory plugin
Public-facing WordPress installations exposing the vulnerable listingfields parameter

Discovery Timeline

2024-05-22 - CVE-2024-4443 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4443

Vulnerability Analysis

The Business Directory Plugin allows users to publish listings with custom fields. The plugin processes the listingfields parameter when handling select-type field queries. The handler passes user-supplied input directly into an SQL statement without using prepared statements or proper escaping. This permits an attacker to break out of the intended query context and inject arbitrary SQL fragments.

Because the injection point does not return results directly to the response body, attackers leverage time-based techniques. Payloads use functions such as SLEEP() or conditional BENCHMARK() calls to infer data one bit at a time based on response delays. Repeated requests allow extraction of database schemas, user records, and authentication hashes stored in the wp_users table.

The EPSS score of 10.27% places this issue in the 95th percentile for exploitation probability, indicating active interest from threat actors targeting WordPress ecosystems.

Root Cause

The root cause lies in class-fieldtypes-select.php at line 110, where the plugin builds an SQL query using the listingfields parameter without invoking $wpdb->prepare() or applying esc_sql() sanitization. WordPress provides parameterized query APIs, but the affected code path concatenates raw user input into the query string.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running the vulnerable plugin. The request includes a malicious listingfields value containing SQL syntax such as a UNION clause or a conditional time-delay payload. The server executes the manipulated query against the WordPress database, and the attacker measures response timing to extract data. No user interaction or authentication is required, and the attack works over the network against any reachable endpoint.

For technical details, see the WordPress Plugin Source Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-4443

Indicators of Compromise

HTTP requests containing the listingfields parameter with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or -- comment sequences
Web server access logs showing repeated requests to Business Directory endpoints with abnormally long response times
Unusual outbound database query patterns from the WordPress host targeting the wp_users or wp_options tables
New or modified administrator accounts in the WordPress database following suspicious request bursts

Detection Strategies

Inspect web application firewall (WAF) logs for SQL injection signatures in query strings and POST bodies targeting Business Directory routes
Correlate database slow-query logs with HTTP requests to identify time-based injection attempts
Monitor for sequential requests from a single source IP exhibiting incremental response delays characteristic of blind SQLi enumeration

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF and forward events to a centralized analytics platform
Alert on HTTP request parameters containing SQL meta-characters when targeting the /wp-admin/admin-ajax.php or directory listing endpoints
Track plugin version inventory across managed WordPress sites and flag any host running Business Directory Plugin 6.4.2 or earlier

How to Mitigate CVE-2024-4443

Immediate Actions Required

Update the Business Directory Plugin to version 6.4.3 or later on all WordPress installations
Audit WordPress sites to identify any instance of businessdirectoryplugin/business_directory at vulnerable versions
Review database query logs and administrator accounts for signs of prior exploitation
Rotate WordPress administrator credentials and any secrets stored in wp_options if compromise is suspected

Patch Information

The vendor released a fix in the Business Directory Plugin code repository. Review the WordPress Changeset Update for the specific code changes that introduce proper query preparation. Site operators should apply the update through the WordPress plugin management interface or by deploying the patched plugin files directly.

Workarounds

Deploy a WAF rule blocking requests where the listingfields parameter contains SQL keywords or control characters
Temporarily deactivate the Business Directory Plugin until the patched version is installed
Restrict access to the WordPress directory listing pages using IP allowlists where business requirements permit

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in listingfields
SecRule ARGS:listingfields "@rx (?i)(union(.*?)select|sleep\(|benchmark\(|--|/\*)" \
    "id:1004443,phase:2,deny,status:403,msg:'CVE-2024-4443 SQLi attempt blocked'"