CVE-2024-51818: Fancy Product Designer SQL Injection

CVE-2024-51818 Overview

CVE-2024-51818 is an unauthenticated SQL injection vulnerability in the radykal Fancy Product Designer plugin for WordPress. The flaw affects all versions of fancy-product-designer up to and including 6.4.3. Attackers can send crafted requests over the network without authentication or user interaction to inject arbitrary SQL into backend queries. The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. With an EPSS probability of 19.264% in the 95th percentile, this issue ranks among the more likely candidates for active exploitation attempts against WordPress sites.

Critical Impact

Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, potentially exposing customer data, order records, and administrative content stored by the plugin.

Affected Products

• radykal Fancy Product Designer plugin for WordPress
• All versions from initial release through 6.4.3
• WordPress sites using fancy-product-designer for product customization

Discovery Timeline

• 2025-01-21 - CVE-2024-51818 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51818

Vulnerability Analysis

The Fancy Product Designer plugin fails to properly neutralize special characters in user-supplied input before passing the data to SQL queries. An unauthenticated remote attacker can craft HTTP requests containing SQL metacharacters that the plugin concatenates directly into database statements. Because no authentication is required, any internet-exposed WordPress site running a vulnerable build can be targeted directly. The scope is marked as changed in the advisory, indicating the injected query can affect data outside the plugin's own component boundary, including core WordPress tables such as wp_users and wp_options.

Root Cause

The root cause is missing or insufficient parameterization in one or more plugin endpoints that accept user-controlled input. Rather than using prepared statements through the $wpdb->prepare() API, the affected code path appears to interpolate request parameters into raw SQL strings. This pattern enables classic in-band and blind SQL injection techniques against the underlying MySQL or MariaDB instance.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker sends an HTTP request to a vulnerable plugin endpoint with malicious payloads embedded in parameters that reach the SQL layer unsanitized. The vulnerability manifests at the parameter handling boundary between the plugin's request handlers and the WordPress database abstraction layer. Refer to the Patchstack advisory for parameter-level technical details.

Detection Methods for CVE-2024-51818

Indicators of Compromise

• HTTP requests to Fancy Product Designer endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or encoded variants in query parameters or POST bodies
• Unexpected database errors in PHP or web server logs referencing plugin files under /wp-content/plugins/fancy-product-designer/
• Anomalous outbound traffic from the WordPress host following inbound requests to plugin endpoints
• New or modified administrator accounts in wp_users without corresponding admin console activity

Detection Strategies

• Inspect web server access logs for requests to fancy-product-designer routes containing SQL metacharacters such as single quotes, comment markers (--, #), or boolean payloads
• Monitor database query logs for statements originating from plugin code paths that include concatenated user input
• Deploy WAF rules targeting common SQL injection signatures on URLs containing fancy-product-designer

Monitoring Recommendations

• Alert on time-based SQL injection patterns including repeated SLEEP() or BENCHMARK() invocations in request strings
• Track failed and successful HTTP responses for plugin endpoints to identify enumeration and exfiltration attempts
• Correlate WordPress audit log events for user, role, and option changes with web traffic to plugin URLs

How to Mitigate CVE-2024-51818

Immediate Actions Required

• Update Fancy Product Designer to a release later than 6.4.3 once published by radykal, or remove the plugin if no patched version is available
• Restrict access to the plugin's endpoints at the web server or WAF layer until patching is complete
• Review database contents for unauthorized accounts, modified options, and signs of data exfiltration
• Rotate WordPress administrator passwords, secret keys in wp-config.php, and any credentials stored in the database

Patch Information

The advisory lists all versions up to and including 6.4.3 as vulnerable. Site administrators should consult the Patchstack vulnerability database entry for the latest fixed version and apply the vendor update through the WordPress plugin manager once available.

Workarounds

• Deploy a virtual patch through a WAF that blocks SQL injection payloads to URLs matching /wp-content/plugins/fancy-product-designer/
• Disable and remove the plugin from production sites until a fixed release is installed
• Apply database least-privilege by ensuring the WordPress database user lacks FILE, SUPER, and cross-database privileges

# Example WAF rule (ModSecurity) to block SQLi payloads to the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/fancy-product-designer/" \
    "id:1005181,phase:2,deny,status:403,\
    chain,msg:'Block SQLi against Fancy Product Designer CVE-2024-51818'"
    SecRule ARGS "@rx (?i)(union(.*?)select|sleep\(|benchmark\(|--\s|/\*)" \
        "t:none,t:urlDecodeUni"