CVE-2024-55979 Overview
CVE-2024-55979 is a SQL injection vulnerability in the robindkumar Wr Age Verification WordPress plugin (wr-age-verification). The flaw affects all plugin versions up to and including 2.0.0. Improper neutralization of special elements in SQL commands [CWE-89] allows authenticated attackers with low privileges to inject arbitrary SQL statements. Successful exploitation exposes database contents and can affect availability of the WordPress backend. The issue is tracked in the Patchstack SQL Injection Advisory.
Critical Impact
Authenticated attackers can extract sensitive database contents from WordPress sites running vulnerable versions of the Wr Age Verification plugin.
Affected Products
- Wr Age Verification WordPress plugin (wr-age-verification) versions through 2.0.0
- WordPress installations with the robindkumar Wr Age Verification plugin enabled
- Sites running any release prior to a Patchstack-listed remediation
Discovery Timeline
- 2024-12-16 - CVE-2024-55979 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-55979
Vulnerability Analysis
The vulnerability is a SQL injection flaw [CWE-89] in the Wr Age Verification WordPress plugin. The plugin fails to properly neutralize special characters in user-supplied input before incorporating that input into SQL queries executed against the WordPress database. An authenticated user with low-level privileges can submit crafted parameters that break out of the intended query context. The resulting query executes attacker-controlled SQL against the underlying database engine.
Exploitation impacts confidentiality of database records and can disrupt availability of dependent site functions. Integrity of stored data is not directly affected according to the published scoring. The scope is changed because the injected query can reach data outside the plugin's own tables, including WordPress core tables such as wp_users and wp_options.
Root Cause
The root cause is the absence of parameterized queries or WordPress-provided sanitization helpers such as $wpdb->prepare(). Plugin code concatenates request input directly into SQL statements. Without input validation or escaping through esc_sql(), hostile payloads pass through unchanged and alter query structure.
Attack Vector
The attack vector is network-based and requires authentication at a low privilege level. An attacker sends a crafted HTTP request to a vulnerable plugin endpoint. No user interaction is required beyond the attacker's own session. Because the vulnerability affects a public-facing WordPress plugin, any site permitting subscriber-level or contributor-level accounts is exposed. See the Patchstack SQL Injection Advisory for endpoint specifics.
// No verified proof-of-concept has been published.
// Refer to the Patchstack advisory for technical detail.
Detection Methods for CVE-2024-55979
Indicators of Compromise
- Unexpected SELECT, UNION, or SLEEP fragments observed in WordPress request logs targeting plugin endpoints under /wp-admin/admin-ajax.php or plugin-specific handlers
- Sudden spikes in database query duration or error rate correlated with requests referencing the wr-age-verification plugin
- New or modified administrative users in wp_users that cannot be attributed to legitimate account provisioning
Detection Strategies
- Inspect WordPress access logs for authenticated requests containing SQL metacharacters such as ', --, /*, or UNION sent to plugin endpoints
- Enable WordPress SAVEQUERIES or database-tier query logging to capture anomalous statements originating from PHP worker processes
- Deploy a WordPress-aware web application firewall ruleset that flags SQL injection patterns targeting plugin parameters
Monitoring Recommendations
- Alert on any authenticated POST or GET traffic to wr-age-verification handlers containing encoded SQL keywords
- Track privilege changes and new administrator creation events across the wp_users and wp_usermeta tables
- Correlate WordPress authentication events with outbound database queries to detect low-privileged accounts accessing sensitive tables
How to Mitigate CVE-2024-55979
Immediate Actions Required
- Disable and remove the Wr Age Verification plugin on any site running version 2.0.0 or earlier until a fixed release is confirmed
- Rotate WordPress administrator credentials and any database credentials that may have been exposed through prior exploitation
- Audit wp_users for unauthorized accounts and review recent posts, options, and plugin settings for tampering
Patch Information
At the time of this writing, no fixed version is listed in the NVD entry for CVE-2024-55979. Site operators should monitor the Patchstack SQL Injection Advisory and the plugin's WordPress.org listing for an updated release beyond 2.0.0.
Workarounds
- Restrict registration and lower-privilege account creation on affected WordPress sites to limit the authenticated attack surface
- Apply virtual patching through a web application firewall to block SQL injection payloads targeting plugin endpoints
- Replace the plugin with a maintained age-verification alternative that supports prepared statements
# Disable the vulnerable plugin from the command line using WP-CLI
wp plugin deactivate wr-age-verification
wp plugin delete wr-age-verification
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
