CVE-2024-52495: Distance Based Shipping Calculator SQLi

CVE-2024-52495 Overview

CVE-2024-52495 is a SQL injection vulnerability in the Enituretechnology Distance Based Shipping Calculator plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.23. Authenticated attackers with low privileges can inject malicious SQL statements through unsanitized input passed to database queries. Successful exploitation exposes sensitive data stored in the WordPress database and can affect components beyond the vulnerable plugin due to the scope change described in the CVSS vector.

Critical Impact
An authenticated attacker can extract confidential data from the WordPress database and disrupt shipping calculator availability across affected e-commerce sites.

Affected Products

Enituretechnology Distance Based Shipping Calculator plugin for WordPress
All versions from initial release through 2.0.23
WordPress e-commerce sites using the distance-based-shipping-calculator plugin

Discovery Timeline

2024-11-28 - CVE-2024-52495 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52495

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. The Distance Based Shipping Calculator plugin fails to sanitize or parameterize user-supplied input before incorporating it into SQL queries. An authenticated user with low privileges can inject arbitrary SQL fragments through parameters processed by the plugin.

The scope change in the CVSS vector indicates that successful exploitation impacts resources beyond the vulnerable component. An attacker can read confidential data from any table accessible to the WordPress database user, including credentials stored in wp_users and session tokens in wp_usermeta.

Root Cause

The plugin concatenates untrusted input directly into SQL statements rather than using prepared statements or the WordPress $wpdb->prepare() API. Missing input validation on plugin request handlers permits injection of SQL metacharacters such as single quotes, UNION SELECT clauses, and comment sequences.

Attack Vector

An attacker authenticated as a low-privileged user, such as a subscriber or customer, sends crafted HTTP requests to the plugin's vulnerable endpoints. The request payload contains SQL syntax that alters the intended query. The database returns data controlled by the attacker's injected clauses. No user interaction is required to trigger exploitation.

Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-52495

Indicators of Compromise

HTTP requests to wp-admin/admin-ajax.php or plugin endpoints containing SQL metacharacters such as UNION, SELECT, SLEEP(, or --
Unexpected wp_users or wp_options reads originating from plugin request handlers
Database error messages returned in HTTP responses referencing distance-based-shipping-calculator query paths
Authenticated sessions from low-privileged accounts generating high volumes of plugin API calls

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection payload patterns targeting the plugin's request parameters
Enable MySQL general query logging on WordPress hosts and alert on queries containing tautologies such as OR 1=1 from plugin execution paths
Correlate authentication events with anomalous plugin endpoint activity using SIEM detections

Monitoring Recommendations

Monitor WordPress access logs for spikes in requests to distance-based-shipping-calculator endpoints from single authenticated sessions
Track outbound data volumes from the WordPress host to detect bulk database exfiltration
Alert on new admin account creation or password resets following suspicious plugin request activity

How to Mitigate CVE-2024-52495

Immediate Actions Required

Update the Distance Based Shipping Calculator plugin to a version later than 2.0.23 once the vendor publishes a fix
Audit WordPress user accounts and remove unnecessary low-privileged accounts that could serve as attack prerequisites
Rotate WordPress database credentials and administrator passwords if exploitation is suspected
Review database logs for evidence of unauthorized SELECT queries against sensitive tables

Patch Information

As of publication, the Patchstack advisory identifies all versions through 2.0.23 as vulnerable. Administrators should monitor the plugin repository for a patched release and apply updates immediately upon availability.

Workarounds

Deactivate and remove the Distance Based Shipping Calculator plugin until a patched version is available
Restrict plugin endpoint access using WAF rules or WordPress role restrictions that limit which authenticated users can invoke shipping calculator functions
Apply the principle of least privilege to the WordPress database user, removing access to tables the plugin does not require

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate distance-based-shipping-calculator
wp plugin delete distance-based-shipping-calculator