CVE-2024-55973 Overview
CVE-2024-55973 is a SQL Injection vulnerability affecting the rnystrom TSB Occasion Editor WordPress plugin (tsb-occasion-editor). The flaw exists in all versions up to and including 1.2.1. Authenticated attackers with low privileges can inject arbitrary SQL commands into database queries through improperly neutralized special elements [CWE-89].
The vulnerability carries a CVSS 3.1 score of 8.5, reflecting a scope change that allows impact beyond the vulnerable component. Exploitation requires network access and low privileges but no user interaction.
Critical Impact
Authenticated attackers can extract sensitive database contents, including WordPress user credentials, session tokens, and configuration data, by injecting malicious SQL into plugin queries.
Affected Products
- rnystrom TSB Occasion Editor (tsb-occasion-editor) WordPress plugin
- All versions from initial release through 1.2.1
- WordPress installations with the plugin activated
Discovery Timeline
- 2024-12-16 - CVE-2024-55973 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55973
Vulnerability Analysis
The TSB Occasion Editor plugin fails to properly neutralize special elements passed to SQL queries. User-supplied input reaches database query construction without adequate sanitization or parameterization. This classifies the issue under [CWE-89]: Improper Neutralization of Special Elements used in an SQL Command.
The scope change component in the CVSS vector indicates that a successful exploit affects resources beyond the plugin itself. An attacker can pivot from injecting into plugin queries to reading data across the entire WordPress database, including tables owned by the WordPress core and other plugins.
EPSS data places the exploitation probability at 0.502% with a percentile of 40.35 as of August 2026. No public proof-of-concept exploit or CISA KEV listing is currently associated with this CVE.
Root Cause
The root cause is direct concatenation of untrusted input into SQL statements within the plugin code. WordPress provides $wpdb->prepare() for parameterized queries, but the affected code paths bypass this safeguard. Special SQL metacharacters such as single quotes, semicolons, and comment markers pass through unescaped.
Attack Vector
An authenticated user with contributor-level or similar low-privilege access to the WordPress admin interface sends crafted parameters to plugin endpoints. The plugin passes these parameters into database queries, where injected SQL executes with the privileges of the WordPress database user. Confidentiality impact is high; integrity impact is none and availability impact is low, per the CVSS vector.
The vulnerability manifests in plugin request handlers that accept editor parameters. Refer to the Patchstack SQL Injection Advisory for technical details on the affected code paths.
Detection Methods for CVE-2024-55973
Indicators of Compromise
- Unexpected UNION SELECT, SLEEP(), or BENCHMARK() patterns in web server access logs targeting tsb-occasion-editor endpoints
- Anomalous authenticated requests from low-privilege WordPress accounts to plugin admin-ajax handlers
- Database error messages referencing SQL syntax exposed in HTTP responses
- Unusual outbound queries against wp_users or wp_usermeta tables originating from the plugin context
Detection Strategies
- Deploy web application firewall rules that identify SQL injection payloads in requests to /wp-content/plugins/tsb-occasion-editor/ paths
- Enable WordPress query logging and alert on queries containing suspicious tautologies such as OR 1=1 or stacked statements
- Correlate authenticated session activity with database query anomalies using SIEM analytics
Monitoring Recommendations
- Ingest WordPress access logs and MySQL general query logs into a centralized data lake for retrospective analysis
- Monitor for privilege enumeration patterns following authentication events on WordPress sites running the plugin
- Alert on rapid successive requests to the same plugin endpoint with varying query string parameters
How to Mitigate CVE-2024-55973
Immediate Actions Required
- Deactivate and remove the TSB Occasion Editor plugin until a patched release becomes available
- Audit WordPress user accounts and rotate credentials for any account that could have accessed the plugin
- Review database contents for evidence of unauthorized data extraction or modification
- Restrict WordPress admin access to trusted IP ranges via server-level controls
Patch Information
At the time of publication, no fixed version beyond 1.2.1 is referenced in the enriched CVE data. Consult the Patchstack SQL Injection Advisory for the current patch status and vendor communications.
Workarounds
- Remove the plugin entirely from production WordPress installations until a fix is confirmed
- Apply virtual patching through a WAF that blocks SQL metacharacters in requests to plugin endpoints
- Enforce least-privilege database credentials so the WordPress database user cannot read tables outside its schema
- Enable multi-factor authentication for all WordPress accounts to raise the cost of achieving the required low-privilege access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
