CVE-2024-52435: WPDM Premium Packages SQL Injection Flaw

CVE-2024-52435 Overview

CVE-2024-52435 is a SQL Injection vulnerability in the Shahjada WPDM – Premium Packages plugin for WordPress. The flaw affects all versions of wpdm-premium-packages up to and including 6.0.5. Attackers with high privileges can inject arbitrary SQL statements through unsanitized input passed to database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated attacker can extract, modify, or delete data stored in the WordPress database, leading to full site compromise.

Affected Products

WPDM – Premium Packages (wpdm-premium-packages) versions through 6.0.5
WordPress sites running the WPDownloadManager Premium Packages – Sell Digital Products Securely plugin
All WordPress deployments that expose the plugin's vulnerable endpoints to authenticated users

Discovery Timeline

2024-11-18 - CVE-2024-52435 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52435

Vulnerability Analysis

The WPDM – Premium Packages plugin fails to properly neutralize special elements in user-supplied input before incorporating that input into SQL statements. When an authenticated user with elevated privileges submits crafted parameters to a vulnerable endpoint, the plugin concatenates the input directly into a database query. The database engine then executes attacker-controlled SQL. The vulnerability affects the network attack surface of any WordPress site running the plugin at version 6.0.5 or earlier.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements or parameterized queries in the plugin's database access layer. User-controlled values reach the SQL query without escaping through WordPress helpers such as $wpdb->prepare() or esc_sql(). This is a textbook [CWE-89] weakness.

Attack Vector

Exploitation requires an authenticated session with high privileges on the target WordPress site. The attacker submits a crafted HTTP request containing SQL metacharacters in a vulnerable parameter. The plugin passes the payload to the database, which executes the injected statements. No user interaction is required beyond the attacker's own request. Technical specifics are documented in the Patchstack SQL Injection Vulnerability advisory.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Patchstack advisory for sanitized technical details.

Detection Methods for CVE-2024-52435

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, --, or INFORMATION_SCHEMA in WordPress access logs targeting wpdm-premium-packages endpoints
Anomalous administrator or editor sessions issuing repeated requests to plugin URLs with unusual query parameters
Sudden creation, modification, or dumping of rows in wp_users, wp_options, or plugin-specific tables
Outbound database errors surfaced in HTTP responses or PHP error logs referencing WPDM plugin files

Detection Strategies

Enable and review WordPress query logging to identify malformed statements originating from the plugin
Deploy a Web Application Firewall rule set that flags SQL injection payloads sent to /wp-admin/admin-ajax.php and plugin routes
Correlate authenticated request patterns with database error spikes to surface exploitation attempts
Baseline normal plugin usage and alert on deviations in parameter length, character sets, and request frequency

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized analytics platform for retention and query
Monitor privileged WordPress account activity, including administrator, editor, and shop manager roles
Alert on file integrity changes to plugin directories under wp-content/plugins/wpdm-premium-packages/
Track outbound network connections from the WordPress host to detect data exfiltration following successful injection

How to Mitigate CVE-2024-52435

Immediate Actions Required

Update WPDM – Premium Packages to a version later than 6.0.5 as soon as the vendor publishes a fixed release
Audit WordPress user accounts and remove or downgrade privileges that are not strictly required
Rotate database credentials and WordPress secret keys if exploitation is suspected
Review recent database changes and back up the site before applying updates

Patch Information

The vulnerability affects WPDM – Premium Packages versions up to and including 6.0.5. Site administrators should consult the Patchstack advisory and the plugin's changelog on the WordPress.org repository for the fixed release version. Apply the update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate the WPDM – Premium Packages plugin until a patched version is installed
Restrict access to WordPress administrative endpoints by IP allowlist at the web server or WAF layer
Enforce least privilege on WordPress roles so that only trusted accounts retain the privileges required to reach the vulnerable code path
Deploy a virtual patch through a WAF that blocks SQL metacharacters in requests to plugin URLs

bash

# Update the plugin using WP-CLI once a fixed version is available
wp plugin update wpdm-premium-packages

# Or deactivate the plugin as a temporary workaround
wp plugin deactivate wpdm-premium-packages