CVE-2024-51818: Fancy Product Designer SQL Injection

CVE-2024-51818 Overview

CVE-2024-51818 is an unauthenticated SQL injection vulnerability in the radykal Fancy Product Designer plugin for WordPress. The flaw affects all versions of fancy-product-designer up to and including 6.4.3. Attackers can send crafted requests over the network without authentication or user interaction to inject arbitrary SQL into backend queries. The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. With an EPSS probability of 19.264% in the 95th percentile, this issue ranks among the more likely candidates for active exploitation attempts against WordPress sites.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, potentially exposing customer data, order records, and administrative content stored by the plugin.

Affected Products

radykal Fancy Product Designer plugin for WordPress
All versions from initial release through 6.4.3
WordPress sites using fancy-product-designer for product customization

Discovery Timeline

2025-01-21 - CVE-2024-51818 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51818

Vulnerability Analysis

The Fancy Product Designer plugin fails to properly neutralize special characters in user-supplied input before passing the data to SQL queries. An unauthenticated remote attacker can craft HTTP requests containing SQL metacharacters that the plugin concatenates directly into database statements. Because no authentication is required, any internet-exposed WordPress site running a vulnerable build can be targeted directly. The scope is marked as changed in the advisory, indicating the injected query can affect data outside the plugin's own component boundary, including core WordPress tables such as wp_users and wp_options.

Root Cause

The root cause is missing or insufficient parameterization in one or more plugin endpoints that accept user-controlled input. Rather than using prepared statements through the $wpdb->prepare() API, the affected code path appears to interpolate request parameters into raw SQL strings. This pattern enables classic in-band and blind SQL injection techniques against the underlying MySQL or MariaDB instance.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker sends an HTTP request to a vulnerable plugin endpoint with malicious payloads embedded in parameters that reach the SQL layer unsanitized. The vulnerability manifests at the parameter handling boundary between the plugin's request handlers and the WordPress database abstraction layer. Refer to the Patchstack advisory for parameter-level technical details.

Detection Methods for CVE-2024-51818

Indicators of Compromise

HTTP requests to Fancy Product Designer endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or encoded variants in query parameters or POST bodies
Unexpected database errors in PHP or web server logs referencing plugin files under /wp-content/plugins/fancy-product-designer/
Anomalous outbound traffic from the WordPress host following inbound requests to plugin endpoints
New or modified administrator accounts in wp_users without corresponding admin console activity

Detection Strategies

Inspect web server access logs for requests to fancy-product-designer routes containing SQL metacharacters such as single quotes, comment markers (--, #), or boolean payloads
Monitor database query logs for statements originating from plugin code paths that include concatenated user input
Deploy WAF rules targeting common SQL injection signatures on URLs containing fancy-product-designer

Monitoring Recommendations

Alert on time-based SQL injection patterns including repeated SLEEP() or BENCHMARK() invocations in request strings
Track failed and successful HTTP responses for plugin endpoints to identify enumeration and exfiltration attempts
Correlate WordPress audit log events for user, role, and option changes with web traffic to plugin URLs

How to Mitigate CVE-2024-51818

Immediate Actions Required

Update Fancy Product Designer to a release later than 6.4.3 once published by radykal, or remove the plugin if no patched version is available
Restrict access to the plugin's endpoints at the web server or WAF layer until patching is complete
Review database contents for unauthorized accounts, modified options, and signs of data exfiltration
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any credentials stored in the database

Patch Information

The advisory lists all versions up to and including 6.4.3 as vulnerable. Site administrators should consult the Patchstack vulnerability database entry for the latest fixed version and apply the vendor update through the WordPress plugin manager once available.

Workarounds

Deploy a virtual patch through a WAF that blocks SQL injection payloads to URLs matching /wp-content/plugins/fancy-product-designer/
Disable and remove the plugin from production sites until a fixed release is installed
Apply database least-privilege by ensuring the WordPress database user lacks FILE, SUPER, and cross-database privileges

bash

# Example WAF rule (ModSecurity) to block SQLi payloads to the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/fancy-product-designer/" \
    "id:1005181,phase:2,deny,status:403,\
    chain,msg:'Block SQLi against Fancy Product Designer CVE-2024-51818'"
    SecRule ARGS "@rx (?i)(union(.*?)select|sleep\(|benchmark\(|--\s|/\*)" \
        "t:none,t:urlDecodeUni"