CVE-2024-51579: 5 Stars Rating Funnel SQLi Vulnerability

CVE-2024-51579 Overview

CVE-2024-51579 is a SQL injection vulnerability in the Saleswonder Team: Tobias 5 Stars Rating Funnel WordPress plugin (5-stars-rating-funnel). The flaw affects all versions up to and including 1.4.01. The plugin fails to properly neutralize special elements used in SQL commands, allowing an authenticated attacker with low privileges to inject arbitrary SQL statements. The issue is tracked under CWE-89 and was published to the National Vulnerability Database (NVD) on November 9, 2024.

Critical Impact
An authenticated attacker can extract sensitive data from the WordPress database, including user credentials, session tokens, and site configuration, by injecting crafted SQL through vulnerable plugin parameters.

Affected Products

Saleswonder Team: Tobias 5 Stars Rating Funnel plugin for WordPress
All versions from n/a through 1.4.01
WordPress sites with the 5-stars-rating-funnel plugin installed and activated

Discovery Timeline

2024-11-09 - CVE-2024-51579 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51579

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input incorporated into SQL queries executed by the plugin. When the plugin processes requests containing attacker-controlled parameters, it concatenates the values directly into query strings without adequate sanitization or use of prepared statements. This allows an authenticated user to break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access to the WordPress site and a valid low-privileged account. Successful exploitation impacts confidentiality by exposing arbitrary database contents and has a limited availability impact. The scope is changed, meaning the injected SQL can affect resources beyond the vulnerable component, including the broader WordPress database shared by other plugins and core tables.

Root Cause

The root cause is the absence of parameterized queries or input escaping when constructing SQL statements from HTTP request parameters. WordPress provides the $wpdb->prepare() API to bind parameters safely, but the affected code paths in versions up to 1.4.01 bypass this protection. Any string, numeric, or identifier value from the request that reaches these query builders becomes an injection sink.

Attack Vector

An attacker with a valid authenticated session (such as Subscriber or Contributor role) submits crafted requests to plugin endpoints that expose the vulnerable parameters. By supplying SQL metacharacters and UNION SELECT payloads, the attacker retrieves data from arbitrary tables. Time-based and boolean-based blind techniques are also feasible when direct output is not returned. See the Patchstack Vulnerability Report for additional context.

Detection Methods for CVE-2024-51579

Indicators of Compromise

HTTP requests to 5-stars-rating-funnel plugin endpoints containing SQL metacharacters such as ', ", --, UNION, SELECT, SLEEP(, or BENCHMARK(.
Unexpected long response times on plugin endpoints indicating time-based blind SQL injection attempts.
Web server logs showing repeated requests with incrementing offsets or encoded payloads (URL-encoded, double-encoded) targeting plugin parameters.
Database error messages returned in HTTP responses referencing MySQL or wpdb syntax errors.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that identify SQL injection patterns in requests to /wp-admin/admin-ajax.php and plugin-specific URIs.
Enable WordPress database query logging and alert on unexpected UNION, INFORMATION_SCHEMA, or sleep() clauses originating from plugin code paths.
Correlate authenticated low-privileged user activity with anomalous query volumes or errors from the WordPress database.

Monitoring Recommendations

Monitor authenticated sessions from Subscriber and Contributor roles for atypical POST/GET traffic to plugin endpoints.
Alert on outbound data transfers from the WordPress host that follow patterns consistent with database exfiltration.
Review WordPress audit logs for unauthorized reads against the wp_users and wp_usermeta tables.

How to Mitigate CVE-2024-51579

Immediate Actions Required

Update the 5 Stars Rating Funnel plugin to a version later than 1.4.01 once a patched release is available from the vendor.
If no patched version is available, deactivate and remove the 5-stars-rating-funnel plugin from all WordPress sites.
Rotate all WordPress user passwords, secret keys defined in wp-config.php, and any API tokens that may have been exposed via database access.
Audit registered user accounts and remove unauthorized administrator or contributor accounts.

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version guidance. The advisory identifies all releases up to 1.4.01 as vulnerable; administrators should apply the vendor-released update tracked in that advisory.

Workarounds

Restrict registration on the WordPress site to prevent untrusted users from obtaining the low-privileged accounts required for exploitation.
Deploy a WAF with virtual patching rules covering SQL injection against the affected plugin endpoints.
Enforce least-privilege on the MySQL account used by WordPress, denying access to tables outside those required by the application where feasible.
Disable the plugin entirely until an update is applied and verified.

bash

# Disable the vulnerable plugin using WP-CLI
wp plugin deactivate 5-stars-rating-funnel
wp plugin delete 5-stars-rating-funnel

# After a fixed release is available, update and reactivate
wp plugin update 5-stars-rating-funnel
wp plugin activate 5-stars-rating-funnel