CVE-2024-55989: WP Simple Pay Lite Manager SQL Injection Flaw

CVE-2024-55989 Overview

CVE-2024-55989 is a SQL Injection vulnerability in the WP Simple Pay Lite Manager WordPress plugin (stripe-manager) developed by Kyle M Brown. The flaw affects all plugin versions up to and including 1.4. It stems from improper neutralization of special elements used in SQL commands [CWE-89], enabling authenticated attackers with high privileges to inject arbitrary SQL statements. Successful exploitation can expose sensitive data stored in the WordPress database, including payment-related records processed through the Stripe integration.

Critical Impact
An attacker with elevated privileges can execute arbitrary SQL queries against the WordPress database, leading to disclosure of stored records and limited availability impact on the affected site.

Affected Products

WP Simple Pay Lite Manager (stripe-manager) plugin versions up to and including 1.4
WordPress installations running the vulnerable plugin
Sites integrating Stripe payment workflows through this plugin

Discovery Timeline

2024-12-16 - CVE-2024-55989 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55989

Vulnerability Analysis

The vulnerability is a classic SQL Injection weakness [CWE-89] within the WP Simple Pay Lite Manager plugin. The plugin passes user-supplied input into SQL queries without applying proper sanitization, escaping, or parameterization. As a result, an attacker who controls query parameters can alter the intended structure of database statements. Because the plugin operates within the WordPress runtime, injected queries execute with the database privileges granted to the WordPress installation.

Exploitation requires authenticated access with high privileges, but no user interaction. The scope is changed, meaning the vulnerable component can affect resources beyond its own security scope. This raises the practical impact for shared or multi-tenant WordPress environments where the plugin interacts with additional databases or tables.

Root Cause

The root cause is the direct concatenation of untrusted input into SQL statements executed by the plugin. The affected code paths do not use prepared statements or the WordPress $wpdb->prepare() API to enforce parameter binding. Any request parameter reaching these query builders can carry SQL metacharacters that alter query logic.

Attack Vector

The attack vector is network-based. An authenticated administrator or equivalently privileged user submits a crafted request to a plugin endpoint that reflects the input into a database query. The injected payload can extract records using UNION-based techniques, enumerate schemas through boolean or time-based blind injection, or modify query behavior to disclose stored configuration and transaction metadata. See the Patchstack SQL Injection Vulnerability advisory for advisory details.

Detection Methods for CVE-2024-55989

Indicators of Compromise

Unexpected requests to stripe-manager plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA
Anomalous database error entries in PHP or WordPress debug logs referencing plugin query files
Long-running or time-delayed queries originating from HTTP requests to plugin URLs

Detection Strategies

Inspect web server access logs for HTTP parameters targeting plugin endpoints that include SQL syntax or encoded variants
Enable MySQL general query logging temporarily to correlate suspicious HTTP requests with executed statements
Deploy a Web Application Firewall (WAF) with SQL Injection signatures tuned for WordPress plugin traffic

Monitoring Recommendations

Alert on authenticated administrator sessions issuing high volumes of requests to plugin URLs
Monitor for privilege changes, new administrator accounts, and unexpected option updates in the wp_options table
Forward WordPress, PHP, and database logs into a centralized analytics platform for correlation and retention

How to Mitigate CVE-2024-55989

Immediate Actions Required

Disable or remove the WP Simple Pay Lite Manager plugin until a fixed release is available
Rotate WordPress administrator credentials and Stripe API keys stored within the site
Review recent database activity for signs of unauthorized queries or data extraction

Patch Information

At the time of publication, the advisory lists all versions up to and including 1.4 as vulnerable, and no fixed version is identified in the Patchstack advisory. Administrators should track the plugin repository for an updated release and apply it as soon as it becomes available.

Workarounds

Uninstall the stripe-manager plugin and migrate to a maintained alternative for Stripe payment processing
Restrict administrator access to trusted IP ranges via web server ACLs or a WAF
Enforce multi-factor authentication for all high-privilege WordPress accounts to reduce the risk of credential-based exploitation

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate stripe-manager
wp plugin delete stripe-manager