CVE-2024-54258 Overview
CVE-2024-54258 is a SQL Injection vulnerability [CWE-89] in the Anzar Ahmed Ni CRM Lead WordPress plugin. The flaw stems from improper neutralization of special elements passed to SQL commands. It affects all versions of ni-crm-lead up to and including 1.3.0.
An authenticated attacker with low privileges can inject crafted SQL statements through vulnerable input parameters. The scope is changed, meaning exploitation impacts resources beyond the vulnerable component. Successful exploitation leads to high confidentiality impact on the underlying WordPress database.
Critical Impact
A low-privileged authenticated attacker can extract sensitive data from the WordPress database, including customer lead records, user credentials, and CRM data, over the network with no user interaction.
Affected Products
- Anzar Ahmed Ni CRM Lead WordPress plugin, versions up to and including 1.3.0
- WordPress installations with the ni-crm-lead plugin activated
- Downstream CRM data stored in the WordPress MySQL/MariaDB database
Discovery Timeline
- 2024-12-13 - CVE-2024-54258 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54258
Vulnerability Analysis
The Ni CRM Lead plugin fails to properly sanitize or parameterize user-supplied input before concatenating it into SQL queries. This falls under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Attackers supply crafted values containing SQL metacharacters that break out of the intended query context.
Because the CVSS scope is changed, injected SQL can access data beyond the plugin's own tables. This typically includes the WordPress wp_users and wp_usermeta tables, exposing password hashes and session tokens. The vulnerability requires authentication but only at a low privilege level, which is trivially obtainable on sites that permit self-registration or subscriber accounts.
EPSS scoring places exploitation likelihood in the lower range, but SQL injection in WordPress plugins is a routinely automated attack pattern once public details exist.
Root Cause
The plugin constructs SQL queries by concatenating request parameters directly into query strings. It does not use $wpdb->prepare() with placeholder substitution, and it does not apply esc_sql() or input type coercion. See the Patchstack advisory for advisory-level details.
Attack Vector
An attacker authenticates to the WordPress site with any valid low-privilege account. The attacker then sends a crafted HTTP request to a vulnerable ni-crm-lead endpoint, embedding SQL syntax such as UNION SELECT statements or boolean-based blind payloads in parameters that reach the database layer. The server executes the modified query and returns data, error messages, or timing signals that the attacker uses to exfiltrate database contents.
No verified public proof-of-concept code is available. Refer to the vendor advisory for technical specifics.
Detection Methods for CVE-2024-54258
Indicators of Compromise
- HTTP requests to ni-crm-lead plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants like %27 and %20OR%20
- Abnormal spikes in query execution time or MySQL error log entries referencing plugin-owned tables
- Unexpected outbound traffic from the web server following administrative or CRM page access
- New or modified WordPress user accounts with elevated roles created outside change windows
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that flag SQL metacharacters in requests targeting /wp-admin/admin.php?page=ni-crm-lead* and related plugin routes
- Enable WordPress database query logging and alert on queries referencing plugin tables that contain UNION or nested SELECT structures
- Correlate authenticated session activity with anomalous parameter values using web server access logs
Monitoring Recommendations
- Monitor for repeated 500-series responses from plugin endpoints, which often indicate injection probing
- Track authentication events for low-privilege accounts followed by access to CRM administrative pages
- Alert on file integrity changes to plugin files under wp-content/plugins/ni-crm-lead/
How to Mitigate CVE-2024-54258
Immediate Actions Required
- Deactivate and remove the Ni CRM Lead plugin from any WordPress installation running version 1.3.0 or earlier until a fixed release is confirmed
- Rotate all WordPress user passwords and invalidate active sessions, as password hashes may have been exposed
- Audit wp_users and wp_options for unauthorized changes, including new administrator accounts and modified siteurl values
Patch Information
At the time of publication, no vendor-supplied patched version is documented in the enriched data. The Patchstack advisory tracks version 1.3.0 and prior as vulnerable. Consult the Patchstack advisory for the latest fixed version information.
Workarounds
- Restrict access to the plugin's administrative endpoints using web server ACLs or authenticated reverse-proxy rules
- Apply virtual patching via a WAF to block SQL injection payloads targeting ni-crm-lead request parameters
- Enforce least privilege for WordPress accounts and disable open user registration until the plugin is removed or updated
# Emergency mitigation: disable the vulnerable plugin via WP-CLI
wp plugin deactivate ni-crm-lead
wp plugin delete ni-crm-lead
# Verify removal
wp plugin list --status=active | grep -i ni-crm-lead
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
