CVE-2024-51601: Website Price Calculator SQLi Vulnerability

CVE-2024-51601 Overview

CVE-2024-51601 is a SQL Injection vulnerability affecting the Maksym Marko price-calculator-to-your-website WordPress plugin, also known as Website Price Calculator. The flaw affects all plugin versions up to and including 4.1. Authenticated attackers with low privileges can inject arbitrary SQL statements through unsanitized input handled by the plugin. Successful exploitation exposes database contents and can degrade service availability. The issue is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can extract sensitive WordPress database contents, including user credentials and site configuration, by injecting crafted SQL through the vulnerable plugin.

Affected Products

Maksym Marko Website Price Calculator (price-calculator-to-your-website) plugin for WordPress
All versions from n/a through 4.1
WordPress sites with the plugin installed and activated

Discovery Timeline

2024-11-09 - CVE-2024-51601 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51601

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input passed into SQL queries within the Website Price Calculator plugin. The plugin concatenates request parameters into database queries without applying parameterized statements or the WordPress $wpdb->prepare() sanitization API. This allows an authenticated attacker to break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access and low-privilege authentication. The scope is marked as changed, meaning a compromise in the plugin context can affect resources beyond its own security boundary. Confidentiality impact is high because attackers can read arbitrary tables, including wp_users password hashes and secret keys stored in wp_options.

See the Patchstack SQL Injection Analysis for the full technical breakdown.

Root Cause

The root cause is missing input sanitization on parameters consumed by SQL queries inside plugin request handlers. WordPress plugins must sanitize input using functions such as sanitize_text_field() and construct queries with $wpdb->prepare() using placeholders. The Website Price Calculator plugin fails to enforce either control, treating attacker-controlled strings as trusted SQL fragments.

Attack Vector

An authenticated user issues an HTTP request to a vulnerable plugin endpoint with a crafted parameter containing SQL metacharacters. The plugin embeds the parameter directly into a query executed against the WordPress database. The attacker uses UNION-based, error-based, or time-based techniques to enumerate schema and exfiltrate rows. No user interaction from an administrator is required.

Because no verified public proof-of-concept is available at this time, refer to the vendor advisory linked above for the specific parameter and endpoint details.

Detection Methods for CVE-2024-51601

Indicators of Compromise

Web server access logs containing SQL keywords such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or encoded variants in requests to plugin endpoints under /wp-content/plugins/price-calculator-to-your-website/
Anomalously long query strings or POST bodies directed at plugin AJAX handlers (admin-ajax.php with plugin-specific actions)
Database error messages returned in HTTP responses referencing MySQL syntax errors
Unexpected read access to wp_users, wp_usermeta, or wp_options tables from the web application user

Detection Strategies

Deploy Web Application Firewall (WAF) rules matching SQLi payload signatures on requests to the plugin path
Enable MySQL general query logging on staging environments to identify query patterns originating from the plugin
Correlate authenticated WordPress sessions with abnormal database query volume

Monitoring Recommendations

Alert on HTTP 500 responses from plugin endpoints, which often accompany SQLi probing
Monitor for new or unexpected WordPress administrator accounts created after suspicious plugin activity
Track outbound egress from the web server for signs of database exfiltration

How to Mitigate CVE-2024-51601

Immediate Actions Required

Deactivate and remove the Website Price Calculator plugin until a patched version is confirmed available from the vendor
Audit WordPress user accounts and rotate credentials for any account with subscriber privileges or above
Rotate WordPress secret keys and salts in wp-config.php if compromise is suspected
Review database logs for unauthorized SELECT statements against sensitive tables

Patch Information

As of the last NVD update, no fixed version beyond 4.1 has been confirmed in the referenced advisory. Consult the Patchstack advisory for the latest fixed release information and apply updates through the WordPress plugin manager as soon as they are published.

Workarounds

Restrict access to WordPress authenticated endpoints using IP allowlisting where feasible
Deploy a Web Application Firewall with virtual patching rules for CVE-2024-51601 or generic SQLi signatures
Enforce the principle of least privilege on the WordPress database user, removing FILE and unnecessary DDL permissions
Require multi-factor authentication for all WordPress accounts to raise the cost of obtaining the low-privilege access required for exploitation

bash

# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate price-calculator-to-your-website
wp plugin delete price-calculator-to-your-website

# Restrict database user privileges as a defense-in-depth measure
mysql -u root -p -e "REVOKE FILE, CREATE, DROP, ALTER ON *.* FROM 'wordpress_user'@'localhost'; FLUSH PRIVILEGES;"