CVE-2024-55982: Share Buttons Plugin SQL Injection Flaw

CVE-2024-55982 Overview

CVE-2024-55982 is a blind SQL injection vulnerability in the richteam Share Buttons – Social Media WordPress plugin (rich-web-share-button). The flaw affects all versions up to and including 1.0.2. Attackers can inject malicious SQL statements through unsanitized input parameters processed by the plugin. The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation allows attackers to extract sensitive data from the WordPress database, including user credentials and session information. The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Unauthenticated attackers can extract database contents and compromise WordPress sites running vulnerable versions of the Share Buttons – Social Media plugin.

Affected Products

• richteam Share Buttons – Social Media plugin (rich-web-share-button)
• All versions from initial release through 1.0.2
• WordPress installations with the plugin enabled

Discovery Timeline

• 2024-12-16 - CVE-2024-55982 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-55982

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements in SQL commands within the Share Buttons – Social Media plugin. The plugin concatenates user-supplied input directly into SQL queries without proper sanitization or parameterization. Attackers exploit this through blind SQL injection techniques, inferring database contents from application behavior rather than direct output.

Blind SQL injection requires attackers to use boolean-based or time-based payloads. The attacker observes response differences or delays to extract data one character at a time. This technique works even when error messages and query results are not displayed.

The EPSS score of 31.8% places this vulnerability in the 96th percentile for likelihood of exploitation. Automated scanning tools commonly target WordPress plugins with known SQL injection flaws.

Root Cause

The root cause is the direct concatenation of HTTP request parameters into SQL queries. The plugin fails to use prepared statements or the WordPress $wpdb->prepare() API. Input validation routines do not filter or escape SQL metacharacters such as single quotes, semicolons, and SQL keywords.

Attack Vector

Attackers send crafted HTTP requests to vulnerable endpoints exposed by the plugin. The attack requires no authentication and no user interaction. The scope is changed, meaning the impact extends beyond the vulnerable component to the underlying database. Attackers can exfiltrate usernames, password hashes, API keys, and other secrets stored in WordPress tables.

The vulnerability manifests in plugin request handlers that process query parameters or POST data. See the Patchstack SQL Injection Vulnerability advisory for technical details.

Detection Methods for CVE-2024-55982

Indicators of Compromise

• HTTP requests to plugin endpoints containing SQL syntax such as UNION SELECT, SLEEP(, BENCHMARK(, or encoded variants
• Repeated requests to the same endpoint with incrementing payload variations indicating automated injection probing
• Unexpected database query patterns in MySQL slow query logs, particularly queries with long execution times
• New or modified administrator accounts in wp_users without corresponding administrative activity

Detection Strategies

• Deploy web application firewall (WAF) rules that match SQL injection patterns targeting WordPress plugin endpoints
• Enable MySQL general query logging to identify malformed or suspicious queries originating from the plugin
• Monitor HTTP access logs for high request volumes containing URL-encoded SQL metacharacters
• Audit plugin source code for direct use of $wpdb->query() without $wpdb->prepare()

Monitoring Recommendations

• Alert on outbound database connection anomalies and large result set transfers from the WordPress host
• Track plugin version inventory across WordPress installations to identify vulnerable instances
• Correlate WAF blocks with authentication failures and privilege changes within WordPress

How to Mitigate CVE-2024-55982

Immediate Actions Required

• Disable the Share Buttons – Social Media plugin until a patched version is confirmed available
• Apply WAF signatures targeting SQL injection patterns against the rich-web-share-button endpoints
• Rotate WordPress administrator credentials and API keys if exploitation is suspected
• Review the wp_users and wp_usermeta tables for unauthorized accounts or modifications

Patch Information

No fixed version is currently identified in the CVE record. The vulnerability affects all versions through 1.0.2. Monitor the Patchstack advisory and the WordPress plugin repository for updates. Replace the plugin with an actively maintained alternative if no patch is released.

Workarounds

• Remove the plugin entirely from production WordPress installations until a fix is published
• Restrict access to WordPress admin and plugin endpoints using IP allowlisting at the web server or WAF layer
• Apply virtual patching through WAF rules that block SQL metacharacters in parameters processed by the plugin
• Enforce database user least privilege so the WordPress database account cannot read sensitive tables outside the WordPress schema

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate rich-web-share-button
wp plugin delete rich-web-share-button