CVE-2024-55984 Overview
CVE-2024-55984 is a SQL injection vulnerability in the Saksh Escrow System WordPress plugin developed by susheelhbti. The flaw affects all plugin versions up to and including 2.4. Attackers with low-level authenticated access can inject arbitrary SQL commands through unsanitized input parameters. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
The issue carries a CVSS 3.1 base score of 8.5 and a scope-changed impact, meaning exploitation can affect resources beyond the vulnerable component. Successful exploitation allows database content disclosure and limited availability impact.
Critical Impact
Authenticated attackers can extract sensitive database contents from WordPress sites running Saksh Escrow System through version 2.4, exposing user data, escrow transactions, and stored credentials.
Affected Products
- Saksh Escrow System WordPress plugin versions up to and including 2.4
- WordPress installations using the saksh-escrow-system plugin
- All prior releases without a stated lower bound patched version
Discovery Timeline
- 2024-12-18 - CVE-2024-55984 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55984
Vulnerability Analysis
The Saksh Escrow System plugin fails to sanitize or parameterize user-supplied input before incorporating it into SQL statements. This allows attackers to append malicious SQL fragments to legitimate queries executed against the WordPress database. Because the CVSS vector shows scope change with high confidentiality impact, the vulnerable query likely operates in a context where extracted data crosses trust boundaries.
The plugin manages escrow transactions between buyers and sellers, meaning the database stores financial records, user identifiers, and transaction metadata. An attacker with a low-privilege account, such as a subscriber, can weaponize the flaw to enumerate WordPress user tables, extract password hashes, and read escrow records.
An EPSS score of 0.462% places current exploitation probability low, but the plugin's exposure on public WordPress installations increases risk. No public proof-of-concept is currently indexed in Exploit-DB, and CISA has not added the flaw to its Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is direct concatenation of user-controlled input into SQL statements without using WordPress prepared statement APIs such as $wpdb->prepare(). The plugin does not enforce type casting or whitelisting on parameters used in query construction.
Attack Vector
An authenticated attacker sends crafted HTTP requests to plugin endpoints that accept parameters used in database queries. The injected payload manipulates the query logic to return rows the attacker is not authorized to view. The attack requires network access and low privileges but no user interaction, making it viable against any site accepting user registration.
See the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2024-55984
Indicators of Compromise
- Unexpected UNION SELECT, SLEEP(, or INFORMATION_SCHEMA strings in web server access logs targeting saksh-escrow-system endpoints
- Anomalous read volume against the WordPress database from the web application process
- Authenticated sessions from low-privilege accounts issuing sequential requests to plugin action handlers
- Outbound data transfers immediately following plugin request activity
Detection Strategies
- Deploy a web application firewall ruleset that flags SQL metacharacters in plugin request parameters
- Enable MySQL general or slow query logging and search for queries referencing wp_users or wp_usermeta originating from plugin code paths
- Alert on authenticated WordPress accounts issuing requests to plugin AJAX or REST routes at high frequency
Monitoring Recommendations
- Correlate WordPress audit logs with database query logs to identify injection attempts
- Monitor plugin file integrity to detect attackers modifying PHP files after initial database access
- Track new administrator account creation and unexpected wp_options changes following suspicious plugin requests
How to Mitigate CVE-2024-55984
Immediate Actions Required
- Disable and remove the Saksh Escrow System plugin until a patched version is confirmed available
- Rotate all WordPress user passwords and any API keys stored in the database
- Restrict user registration and review existing low-privilege accounts for suspicious activity
- Deploy WAF rules blocking SQL injection patterns against saksh-escrow-system request paths
Patch Information
No fixed version is documented in the advisory. Vulnerable releases include all versions through 2.4. Site operators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release before reinstalling.
Workarounds
- Remove the plugin entirely if escrow functionality is not business-critical
- Place the WordPress admin and plugin endpoints behind IP allowlisting or authenticated proxy
- Apply virtual patching through a WAF that blocks SQL injection payloads targeting plugin parameters
- Restrict database user privileges so the WordPress account cannot read tables outside its schema
# Configuration example: remove vulnerable plugin via WP-CLI
wp plugin deactivate saksh-escrow-system
wp plugin delete saksh-escrow-system
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
