CVE-2024-51621: Download-Mirror-Counter SQL Injection Flaw

CVE-2024-51621 Overview

CVE-2024-51621 is a SQL injection vulnerability in the reza19 Download-Mirror-Counter WordPress plugin (wp-download-mirror-counter). The flaw affects all versions up to and including 1.1. Authenticated attackers with low privileges can inject SQL commands into database queries because the plugin fails to properly neutralize special elements in user-supplied input. Successful exploitation yields access to sensitive database content and can affect availability of the WordPress instance. The issue is tracked under CWE-89 and disclosed through the Patchstack SQL Injection Vulnerability advisory.

Critical Impact
An authenticated attacker can execute arbitrary SQL against the WordPress database, exposing confidential data across a scope-changed boundary and degrading site availability.

Affected Products

reza19 Download-Mirror-Counter WordPress plugin (wp-download-mirror-counter)
All versions from n/a through 1.1
WordPress installations with the plugin enabled

Discovery Timeline

2024-11-09 - CVE-2024-51621 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51621

Vulnerability Analysis

The Download-Mirror-Counter plugin tracks download counts for mirrored files hosted through WordPress. The vulnerable code path accepts request parameters and concatenates them directly into SQL statements sent to the WordPress database. This pattern violates the safe-query contract enforced by the wpdb::prepare() API.

Because the vulnerability requires only low-privilege authentication and no user interaction, any authenticated user who can reach the plugin endpoint can trigger injection. The scope change indicated by the disclosure means the impacted database boundary extends beyond the plugin itself and touches the broader WordPress data store.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The plugin does not sanitize or parameterize user-controlled input before including it in query strings. WordPress plugins must use $wpdb->prepare() with placeholders such as %s and %d, or the safe query builders, to avoid this class of flaw.

Attack Vector

Exploitation is remote and network-accessible. An attacker authenticates to WordPress with any account, then sends a crafted request to the plugin endpoint containing SQL metacharacters and payload fragments. The injected clauses execute in the context of the WordPress database user, allowing UNION-based data extraction, boolean-based inference, or time-based blind extraction of tables such as wp_users and wp_options. Detailed technical background is available in the Patchstack advisory.

Detection Methods for CVE-2024-51621

Indicators of Compromise

Web server logs containing SQL metacharacters such as ', UNION SELECT, SLEEP(, or -- in requests to wp-download-mirror-counter endpoints
Unexpected authenticated requests from low-privilege subscriber accounts targeting the plugin's PHP handlers
MySQL error entries referencing malformed queries originating from the plugin
Sudden spikes in slow query counts correlated with requests to plugin URLs

Detection Strategies

Enable and review WordPress database query logging to flag queries containing untypical UNION, INFORMATION_SCHEMA, or BENCHMARK operations
Deploy a WAF rule set that inspects requests to /wp-content/plugins/wp-download-mirror-counter/ for SQL injection signatures
Correlate authenticated session activity with database anomaly telemetry to surface subscriber-level accounts issuing atypical query volumes

Monitoring Recommendations

Monitor wp_users table reads and password hash exports for unusual patterns
Alert on outbound connections from the WordPress host that could indicate data exfiltration following injection
Track plugin file integrity and version to confirm patched builds remain deployed

How to Mitigate CVE-2024-51621

Immediate Actions Required

Disable and remove the wp-download-mirror-counter plugin until a patched release is confirmed available from the vendor
Rotate all WordPress user passwords and secret keys defined in wp-config.php if exploitation is suspected
Restrict authentication endpoints and disable open user registration where feasible to reduce the pool of low-privilege attackers
Review database audit logs for evidence of unauthorized SELECT activity against sensitive tables

Patch Information

No fixed version is listed in the NVD entry beyond the affected range of n/a through 1.1. Administrators should consult the Patchstack advisory for the current remediation status and upgrade to any vendor-released version above 1.1 as soon as it is published.

Workarounds

Remove the plugin directory from wp-content/plugins/ if a patched version is not yet available
Apply a virtual patch through a Web Application Firewall to block SQL metacharacters on requests targeting the plugin's endpoints
Restrict database user privileges so the WordPress account cannot read tables outside the site schema

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-download-mirror-counter
wp plugin delete wp-download-mirror-counter

# Restrict least-privilege for the WordPress DB user in MySQL
REVOKE ALL PRIVILEGES ON *.* FROM 'wp_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;