CVE-2024-55980: Wr Age Verification SQL Injection Flaw

CVE-2024-55980 Overview

CVE-2024-55980 is an SQL Injection vulnerability affecting the Wr Age Verification WordPress plugin developed by robindkumar. The vulnerability stems from improper neutralization of special elements used in SQL commands, classified under CWE-89. This flaw allows attackers to inject malicious SQL queries through the plugin, potentially compromising the underlying database and any sensitive data stored within.

Critical Impact
Successful exploitation of this SQL Injection vulnerability could allow attackers to read, modify, or delete database contents, potentially leading to complete site compromise, data theft, or privilege escalation within WordPress installations using this plugin.

Affected Products

Wr Age Verification plugin versions through 2.0.0
WordPress installations using the wr-age-verification plugin
All sites running vulnerable versions without additional SQL injection protections

Discovery Timeline

2024-12-16 - CVE-2024-55980 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-55980

Vulnerability Analysis

This SQL Injection vulnerability exists in the Wr Age Verification WordPress plugin, which is designed to restrict content access based on visitor age. The vulnerability arises from insufficient input validation and sanitization when user-supplied data is incorporated into SQL queries. When exploited, an attacker can manipulate database queries to extract sensitive information, modify data, or potentially gain administrative access to the WordPress installation.

The EPSS data indicates a probability score of 2.298% with a percentile rank of 84.695, suggesting this vulnerability ranks higher than approximately 85% of other vulnerabilities in terms of exploitation likelihood. This elevated percentile warrants prompt attention from site administrators.

Root Cause

The root cause of CVE-2024-55980 is the failure to properly sanitize, validate, or parameterize user input before incorporating it into SQL queries. The plugin does not adequately escape special characters or use prepared statements when constructing database queries, allowing attackers to break out of the intended query context and inject arbitrary SQL commands.

WordPress provides built-in functions like $wpdb->prepare() for creating safe parameterized queries, but the vulnerable code in Wr Age Verification fails to utilize these protective measures appropriately.

Attack Vector

The attack can be executed remotely by any user who can interact with the age verification functionality of the plugin. An attacker crafts malicious input containing SQL syntax that, when processed by the plugin, modifies the structure of the backend SQL query. This could be achieved through form submissions, URL parameters, or other input vectors processed by the plugin.

The exploitation mechanism involves injecting SQL metacharacters and commands that escape the intended query context. For example, an attacker might inject boolean-based, time-based, or union-based payloads to extract data or manipulate the database. For detailed technical information about this vulnerability, refer to the Patchstack SQL Injection Advisory.

Detection Methods for CVE-2024-55980

Indicators of Compromise

Unusual database queries in MySQL/MariaDB logs containing SQL injection patterns such as UNION SELECT, OR 1=1, or -- comment sequences
Error messages in WordPress debug logs indicating SQL syntax errors from unexpected input
Unexpected data modifications or new admin accounts appearing in the WordPress database
Web application firewall (WAF) logs showing blocked SQL injection attempts targeting the age verification plugin

Detection Strategies

Deploy web application firewall rules to detect and block common SQL injection patterns in requests to WordPress endpoints
Enable MySQL query logging and monitor for anomalous queries originating from the WordPress application
Implement file integrity monitoring to detect unauthorized changes to the wr-age-verification plugin files
Use WordPress security plugins that can detect vulnerable plugin versions and alert administrators

Monitoring Recommendations

Review access logs for suspicious requests containing SQL metacharacters targeting the age verification plugin endpoints
Configure alerts for database errors that may indicate SQL injection attempts
Monitor WordPress user tables for unauthorized account creation or privilege modifications
Establish baseline database query patterns and alert on deviations that may indicate exploitation

How to Mitigate CVE-2024-55980

Immediate Actions Required

Identify all WordPress installations using the Wr Age Verification plugin version 2.0.0 or earlier
Consider temporarily disabling or removing the wr-age-verification plugin until a patched version is available
Implement web application firewall rules to block SQL injection attempts targeting the plugin
Review database logs for any signs of prior exploitation and check for unauthorized data access or modifications

Patch Information

At the time of publication, the affected versions include Wr Age Verification through version 2.0.0. Site administrators should monitor the Patchstack advisory for updates on patched versions. If a patched version becomes available, update immediately through the WordPress plugin manager.

Workarounds

Deploy a web application firewall (WAF) with SQL injection protection enabled to filter malicious requests
Use WordPress security plugins like Wordfence or Sucuri that provide virtual patching capabilities
If age verification functionality is not critical, disable or remove the plugin entirely until a fix is available
Implement database-level restrictions to limit the WordPress database user's permissions to only necessary operations

bash

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate wr-age-verification

# Verify plugin status
wp plugin list --status=active | grep age-verification

# Check for suspicious database users (run in MySQL)
# SELECT * FROM wp_users WHERE user_registered > DATE_SUB(NOW(), INTERVAL 7 DAY);