CVE-2024-47312: Classic Editor & Widgets SQL Injection

CVE-2024-47312 Overview

CVE-2024-47312 is a SQL Injection vulnerability in the WP Grim Classic Editor and Classic Widgets plugin for WordPress. The flaw affects all versions up to and including 1.4.1. Authenticated attackers with low privileges can inject crafted SQL statements through unsanitized input parameters processed by the plugin.

Successful exploitation exposes database contents and can impact availability of the WordPress backend. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing confidential data and affecting site availability.

Affected Products

• WP Grim Classic Editor and Classic Widgets plugin (classic-editor-and-classic-widgets)
• All versions from initial release through 1.4.1
• WordPress installations with the plugin activated

Discovery Timeline

• 2024-10-17 - CVE-2024-47312 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47312

Vulnerability Analysis

The plugin fails to properly neutralize special elements in user-supplied input before incorporating that input into SQL queries. An attacker holding a low-privileged authenticated session can craft parameter values that alter the intended query structure.

Because the scope changes according to the CVSS vector, exploitation reaches resources beyond the plugin itself, including data managed by other components sharing the WordPress database. The impact profile emphasizes confidentiality disclosure and partial availability loss.

Root Cause

The underlying defect is a failure to parameterize database queries or escape user-controlled input using WordPress helpers such as $wpdb->prepare(). Values received from HTTP requests are concatenated directly into SQL statements, allowing attacker-controlled fragments to be interpreted as query syntax.

Attack Vector

An attacker authenticates to WordPress with any account that has access to the vulnerable plugin endpoint. The attacker sends a request containing SQL metacharacters in a parameter that the plugin passes to the database layer. The injected clause extends the original query, enabling data extraction via UNION-based or boolean-based techniques.

No verified public exploit code is available. See the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2024-47312

Indicators of Compromise

• HTTP request logs containing SQL metacharacters such as ', ", --, UNION SELECT, or SLEEP( targeting plugin endpoints under wp-admin or wp-content/plugins/classic-editor-and-classic-widgets/
• Unexpected wpdb query errors in debug.log referencing plugin file paths
• Anomalous outbound data volumes following authenticated sessions from low-privileged accounts

Detection Strategies

• Deploy a Web Application Firewall (WAF) rule set that identifies SQL injection payloads directed at WordPress plugin routes
• Enable MySQL general query logging and alert on queries containing suspicious UNION, INFORMATION_SCHEMA, or nested SELECT patterns originating from the WordPress user
• Correlate authentication events with database error spikes to identify probing behavior

Monitoring Recommendations

• Track plugin version inventory across WordPress fleets and flag installations at 1.4.1 or earlier
• Monitor privileged database operations executed by the wp_ user context outside normal administrative windows
• Review access logs for repeated 500-series responses on plugin endpoints, which often accompany injection probing

How to Mitigate CVE-2024-47312

Immediate Actions Required

• Deactivate the WP Grim Classic Editor and Classic Widgets plugin until a patched version is confirmed available
• Audit WordPress user accounts and revoke unnecessary contributor or higher privileges
• Rotate database credentials and WordPress secret keys if injection activity is suspected

Patch Information

No vendor-supplied patched version has been published in the referenced advisory at the time of NVD publication. Consult the Patchstack SQL Injection Advisory for the latest remediation status and update to a fixed release when available.

Workarounds

• Remove the plugin from any production WordPress installation and use an alternative editor plugin
• Apply virtual patching through a WAF rule that blocks SQL metacharacters in requests to the plugin's endpoints
• Restrict administrative and contributor access to trusted IP ranges via server-level ACLs

# Example WAF rule (ModSecurity) blocking SQLi patterns on the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/classic-editor-and-classic-widgets/" \
    "id:1004712,phase:2,deny,status:403,\
     chain,msg:'CVE-2024-47312 SQLi attempt'"
    SecRule ARGS "@rx (?i:(union(\s|/\*.*\*/)+select|sleep\s*\(|information_schema|--|';))" \
        "t:none,t:urlDecodeUni"