CVE-2024-55974: Mimoos Devoluciones-Packback SQL Injection

CVE-2024-55974 Overview

CVE-2024-55974 is a SQL Injection vulnerability [CWE-89] in the Martí Batlles Martinez devoluciones-packback (Mimoos) WordPress plugin. The flaw affects all versions of Mimoos from an unspecified initial release through version 1.2. An authenticated attacker with low privileges can inject arbitrary SQL statements through unsanitized input passed into database queries. Successful exploitation exposes confidential data stored in the WordPress database and can affect components beyond the plugin's own scope.

Critical Impact

A low-privileged authenticated attacker can execute arbitrary SQL against the WordPress database, leading to disclosure of sensitive data across the affected site and adjacent components.

Affected Products

• Martí Batlles Martinez Mimoos devoluciones-packback plugin for WordPress
• All versions from initial release through 1.2 (inclusive)
• WordPress sites with the plugin activated and reachable over the network

Discovery Timeline

• 2024-12-16 - CVE-2024-55974 published to the National Vulnerability Database
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-55974

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in SQL commands within the devoluciones-packback plugin. User-controllable parameters are concatenated into SQL statements without prepared statements or adequate escaping through the WordPress $wpdb->prepare() API. An attacker who holds a low-privileged authenticated account, such as a subscriber, can submit crafted values that alter the intent of the underlying query.

Because the scope is changed during exploitation, injected queries can reach data outside the plugin's own tables. This enables extraction of arbitrary rows from the WordPress database, including credentials, session tokens, and personally identifiable information stored by other plugins on the same schema.

Root Cause

The root cause is a failure to sanitize or parameterize user input before it is embedded into SQL statements. The plugin passes request parameters directly into wpdb query strings, bypassing WordPress's built-in query preparation. This is a classic Common Weakness Enumeration [CWE-89] pattern, where input filtering relies on client-side or type-level assumptions that do not hold against a malicious authenticated user.

Attack Vector

Exploitation is performed over the network against a vulnerable WordPress instance. The attacker authenticates with any account that has access to the plugin's endpoints, then submits crafted GET or POST parameters containing SQL metacharacters. No user interaction is required. Refer to the Patchstack SQL Injection Analysis for technical details on the specific injection sinks.

Detection Methods for CVE-2024-55974

Indicators of Compromise

• Web server access logs containing SQL metacharacters such as UNION SELECT, SLEEP(, --, or INFORMATION_SCHEMA in requests targeting devoluciones-packback endpoints
• Unexpected wpdb query errors or long-running database queries originating from authenticated low-privilege sessions
• Newly created WordPress administrator accounts or unexpected changes to the wp_users and wp_usermeta tables

Detection Strategies

• Inspect HTTP request bodies and query strings for SQL injection payload patterns targeting plugin routes under /wp-admin/admin-ajax.php and /wp-content/plugins/devoluciones-packback/
• Correlate authenticated session activity with anomalous database query volume or duration on the MySQL/MariaDB backend
• Alert on WordPress error log entries referencing WordPress database error combined with SELECT or UNION fragments

Monitoring Recommendations

• Enable WordPress database query logging in staging and forward web server plus database logs to a centralized analytics platform for pattern analysis
• Deploy a Web Application Firewall (WAF) with rulesets that identify SQL injection signatures against the plugin's URL paths
• Baseline normal authenticated user query behavior and alert on deviations from that baseline

How to Mitigate CVE-2024-55974

Immediate Actions Required

• Deactivate and remove the devoluciones-packback plugin from any WordPress site running version 1.2 or earlier until a fixed release is available
• Rotate WordPress secret keys in wp-config.php and reset passwords for privileged accounts if the plugin was exposed to untrusted users
• Audit the database for unauthorized rows in wp_users, wp_options, and plugin-specific tables

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the advisory data. Monitor the Patchstack SQL Injection Analysis entry and the plugin's WordPress.org page for a fixed release above version 1.2.

Workarounds

• Restrict access to the plugin's endpoints through server-level access control rules until a patched version is released
• Apply virtual patching via a WAF with a rule that blocks SQL metacharacters on requests to devoluciones-packback routes
• Reduce the number of authenticated low-privilege accounts on affected sites and disable open registration where feasible

# Example nginx configuration to block requests to the vulnerable plugin path
location ~* /wp-content/plugins/devoluciones-packback/ {
    deny all;
    return 403;
}