CVE-2024-55975: Dr Affiliate WordPress SQLi Vulnerability

CVE-2024-55975 Overview

CVE-2024-55975 is a SQL Injection vulnerability in the Rohit Urane Dr Affiliate (dr-affiliate) WordPress plugin. The flaw affects all versions up to and including 1.2.3. It is caused by improper neutralization of special elements used in an SQL command [CWE-89]. Authenticated attackers with low privileges can inject arbitrary SQL through vulnerable input parameters. Successful exploitation exposes confidential database contents and can affect availability of the WordPress backend. The issue was published to the National Vulnerability Database on December 18, 2024.

Critical Impact
Authenticated attackers can extract sensitive data from the WordPress database and impact site availability by injecting crafted SQL statements against the Dr Affiliate plugin.

Affected Products

Rohit Urane Dr Affiliate WordPress plugin, versions up to and including 1.2.3
WordPress sites with the dr-affiliate plugin installed and activated
Any environment where low-privileged users can reach the vulnerable plugin endpoints

Discovery Timeline

2024-12-18 - CVE-2024-55975 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55975

Vulnerability Analysis

The Dr Affiliate plugin fails to sanitize or parameterize user-supplied input before incorporating it into SQL queries. This falls under Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. Attackers with authenticated low-privilege access can inject SQL syntax through affected plugin parameters. The scope changes to include other components beyond the vulnerable plugin, indicating the injection reaches shared database resources used by WordPress core and other plugins. The impact centers on high confidentiality loss and limited availability loss, while integrity remains unaffected in the CVSS assessment.

Root Cause

The root cause is direct concatenation of untrusted input into SQL statements without the use of prepared statements or the WordPress $wpdb->prepare() helper. Missing escaping through functions such as esc_sql() allows attacker-controlled metacharacters to alter the query structure.

Attack Vector

Exploitation occurs over the network against an authenticated session with subscriber-level or higher privileges. The attacker submits crafted values to a vulnerable plugin endpoint. The injected payload manipulates the underlying SQL query to enumerate tables, extract data using UNION-based techniques, or trigger time-based blind extraction. No user interaction is required. See the Patchstack SQL Injection Vulnerability advisory for further technical details.

Detection Methods for CVE-2024-55975

Indicators of Compromise

Unexpected outbound requests originating from the WordPress host following authenticated requests to dr-affiliate plugin endpoints
Web server access logs containing SQL syntax such as UNION SELECT, SLEEP(, information_schema, or encoded variants targeting plugin parameters
Anomalous read patterns against wp_users, wp_usermeta, or wp_options tables from the WordPress application user
New or modified administrator accounts and unfamiliar API tokens in the WordPress database

Detection Strategies

Enable WordPress database query logging or a Web Application Firewall (WAF) in detection mode to capture SQL keywords appearing inside plugin request parameters
Correlate authenticated plugin requests with database error responses or unusually large response payloads
Baseline the request volume and parameter shapes for dr-affiliate endpoints and alert on deviations

Monitoring Recommendations

Forward WordPress, web server, and database logs to a centralized analytics platform for correlation and retention
Alert on repeated 500-series responses from dr-affiliate endpoints, which often indicate injection probing
Monitor authentication logs for low-privilege accounts that begin issuing atypical requests to plugin URLs

How to Mitigate CVE-2024-55975

Immediate Actions Required

Identify all WordPress sites running the Dr Affiliate plugin and confirm the installed version against 1.2.3 or earlier
Deactivate and remove the dr-affiliate plugin on affected sites until a fixed release is verified
Rotate WordPress administrator passwords, API keys, and database credentials if exploitation is suspected
Review the WordPress user table for unauthorized privilege changes

Patch Information

At the time of the referenced advisory, the vulnerability affects versions up to and including 1.2.3. Consult the Patchstack advisory and the plugin vendor for the latest fixed version and update guidance.

Workarounds

Restrict access to the WordPress dashboard and plugin endpoints to trusted IP ranges using web server or WAF rules
Deploy WAF signatures that block SQL injection patterns targeting dr-affiliate parameters
Limit low-privileged account creation and enforce strong authentication to reduce the pool of eligible attackers

bash

# Example nginx rule to block common SQLi patterns against the plugin path
location ~* /wp-content/plugins/dr-affiliate/ {
    if ($args ~* "(union.*select|sleep\(|information_schema|--|/\*)") {
        return 403;
    }
}