CVE-2024-51845: Share Buttons Plugin SQL Injection Flaw

CVE-2024-51845 Overview

CVE-2024-51845 is a blind SQL injection vulnerability in the richteam Share Buttons – Social Media WordPress plugin (rich-web-share-button). The flaw affects all plugin versions up to and including 1.0.2. The vulnerability results from improper neutralization of special elements in SQL commands [CWE-89], allowing authenticated attackers with low privileges to inject arbitrary SQL into backend queries. Because the injection is blind, attackers infer query results from response behavior rather than direct output. The scope is marked as changed, indicating the exploited component can affect resources beyond its security boundary.

Critical Impact
Authenticated attackers can extract sensitive database contents, including WordPress user credentials and session tokens, through blind SQL injection over the network.

Affected Products

richteam Share Buttons – Social Media WordPress plugin (rich-web-share-button)
All plugin versions from n/a through 1.0.2
WordPress sites with the affected plugin installed and activated

Discovery Timeline

2024-11-11 - CVE-2024-51845 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51845

Vulnerability Analysis

The vulnerability exists in the richteam Share Buttons – Social Media plugin, which extends WordPress with social sharing functionality. Input parameters passed to plugin endpoints reach SQL query construction without proper sanitization or parameterization. Attackers submit crafted payloads that alter query semantics against the underlying WordPress database.

The injection is blind, meaning the application does not return database errors or query results directly to the attacker. Instead, attackers use boolean-based or time-based techniques to infer information one bit at a time. Time-based payloads leverage SLEEP() or BENCHMARK() functions to induce measurable delays in server responses.

Successful exploitation exposes contents of the WordPress database, including the wp_users table with password hashes, secret keys, and API tokens stored by other plugins. Because the CVSS scope is changed, the impact extends beyond the plugin itself to the entire WordPress installation and any tenant data hosted alongside it.

Root Cause

The root cause is failure to use prepared statements or the WordPress $wpdb->prepare() API when incorporating user-controlled input into SQL queries. Special characters such as single quotes, comments, and UNION keywords pass through unfiltered, enabling query manipulation.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated access with low privileges. An attacker sends crafted HTTP requests to a plugin endpoint that reaches the vulnerable SQL query. No user interaction is required. The vulnerability manifests through parameter tampering on requests handled by the plugin. See the Patchstack SQL Injection Advisory for advisory details.

Detection Methods for CVE-2024-51845

Indicators of Compromise

HTTP requests to plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Web server access logs showing repeated parameter tampering from authenticated low-privilege user sessions
Unusually long response times on plugin endpoints, indicating time-based blind SQL injection probing
Unexpected reads against wp_users, wp_usermeta, or wp_options tables in database query logs

Detection Strategies

Enable WordPress database query logging and alert on queries referencing sensitive tables originating from plugin request contexts
Deploy a web application firewall (WAF) with rules for SQL injection payloads targeting WordPress plugin routes
Correlate authentication logs with plugin endpoint access to identify low-privilege accounts issuing anomalous parameter values

Monitoring Recommendations

Monitor for authenticated subscriber or contributor accounts issuing requests with SQL syntax in query parameters or POST bodies
Track outbound data volumes from the WordPress host for signs of automated data exfiltration through iterative blind SQLi
Alert on repeated response-time anomalies consistent with time-based inference attacks

How to Mitigate CVE-2024-51845

Immediate Actions Required

Deactivate and remove the rich-web-share-button plugin until a patched version is confirmed installed
Audit WordPress user accounts and rotate credentials, particularly for administrator and low-privilege accounts that may have been abused
Rotate WordPress secret keys and salts in wp-config.php and invalidate active sessions
Review database logs for suspicious queries dating back to plugin installation

Patch Information

At the time of publication, no fixed version beyond 1.0.2 is listed in the advisory. Consult the Patchstack SQL Injection Advisory for the latest remediation status and any released updates from the vendor.

Workarounds

Remove the vulnerable plugin entirely and replace it with a maintained social sharing alternative
Restrict access to plugin endpoints using WAF rules that block SQL injection payload patterns
Enforce least-privilege on WordPress accounts and limit registration to trusted users only
Deploy virtual patching through a WAF such as Patchstack, Wordfence, or ModSecurity with OWASP CRS rules

bash

# Example WAF rule pattern (ModSecurity) to block SQLi payloads on plugin routes
SecRule REQUEST_URI "@contains /wp-content/plugins/rich-web-share-button/" \
    "id:1005184,phase:2,deny,status:403,\
     chain,msg:'Block SQLi on rich-web-share-button'"
    SecRule ARGS "@rx (?i)(union\s+select|sleep\s*\(|benchmark\s*\(|--|/\*)" \
        "t:none,t:urlDecodeUni"