CVE-2024-6265: Ayecode UsersWP SQLi Vulnerability

CVE-2024-6265 Overview

CVE-2024-6265 is a time-based SQL injection vulnerability in the UsersWP WordPress plugin developed by AyeCode. The plugin provides front-end login forms, user registration, user profiles, and members directory functionality. All versions up to and including 1.2.10 are affected. The flaw resides in the handling of the uwp_sort_by parameter, which is incorporated into a SQL query without sufficient escaping or use of prepared statements. Unauthenticated attackers can append SQL clauses to existing queries to extract sensitive data from the WordPress database, including user credentials and session information.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary database contents through time-based SQL injection, leading to full WordPress site compromise.

Affected Products

AyeCode UsersWP plugin for WordPress, versions up to and including 1.2.10
WordPress sites running the UsersWP front-end login, registration, and members directory module
Any site exposing the uwp_sort_by parameter to unauthenticated visitors

Discovery Timeline

2024-06-29 - CVE-2024-6265 published to the National Vulnerability Database
2024-06-29 - Vendor patch released via WordPress plugin changeset 3106884
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-6265

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. The UsersWP plugin accepts the uwp_sort_by request parameter to determine how user listings in the members directory are ordered. The plugin concatenates this user-controlled value into a raw SQL query before passing it to the WordPress database layer. Because the value is neither escaped nor bound through a prepared statement, attackers can inject additional SQL syntax that the database executes alongside the legitimate query.

Exploitation does not require authentication. The members directory page is typically exposed to anonymous visitors, making the attack vector reachable across the public network. Successful exploitation allows extraction of WordPress user hashes from wp_users, secret keys, API tokens, and arbitrary post or option data.

Root Cause

The defective code path is in admin/settings/class-uwp-settings-user-sorting.php around line 45. The handler reads uwp_sort_by from the request and inserts it directly into an ORDER BY clause. WordPress's $wpdb->prepare() cannot parametrize identifiers such as column names, so the developer relied on implicit trust of the input rather than validating it against a strict allowlist of permitted sort fields.

Attack Vector

An attacker issues an HTTP request to a members directory endpoint and supplies a crafted uwp_sort_by value containing SQL payloads. Time-based techniques such as SLEEP() or BENCHMARK() reveal data through observable response delays, since the injection occurs within an ORDER BY clause where conventional UNION-based extraction is constrained. The attacker iteratively reconstructs database contents by issuing many requests and measuring response times. No user interaction is required.

For technical details, see the WordPress Plugin Source File and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-6265

Indicators of Compromise

HTTP requests containing the uwp_sort_by parameter with SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or IF( in URL-encoded form
Web server access logs showing repeated requests to UsersWP directory endpoints from a single source with response times that vary by several seconds
Database slow query log entries referencing the users or usermeta tables driven by malformed ORDER BY clauses

Detection Strategies

Inspect WordPress access logs for query strings containing uwp_sort_by= followed by characters outside an expected allowlist of column names
Deploy a Web Application Firewall (WAF) rule that blocks SQL metacharacters in the uwp_sort_by parameter
Correlate slow HTTP responses on UsersWP endpoints with concurrent database query latency spikes

Monitoring Recommendations

Enable WordPress debug logging and MySQL general query logging on staging environments to baseline normal UsersWP queries
Alert on unauthenticated requests producing response times above a defined threshold on members directory URLs
Monitor outbound database connections and process telemetry on the WordPress host for anomalous wp_users enumeration patterns

How to Mitigate CVE-2024-6265

Immediate Actions Required

Upgrade the UsersWP plugin to a version newer than 1.2.10 that includes the fix from changeset 3106884
Audit WordPress user accounts, rotate administrator passwords, and revoke active sessions after patching
Regenerate WordPress secret keys in wp-config.php if exploitation is suspected

Patch Information

The vendor remediated the issue in the WordPress plugin repository through changeset 3106884. The fix introduces strict validation of the uwp_sort_by parameter against an allowlist of permitted sort columns and removes direct concatenation of user input into the SQL query. Site administrators should apply the update via the WordPress plugin manager.

Workarounds

Temporarily deactivate the UsersWP plugin until the patched release can be installed
Restrict access to members directory pages with HTTP authentication or IP allowlisting at the web server layer
Add a WAF signature that drops requests where uwp_sort_by contains anything other than alphanumeric characters or underscores

bash

# Example ModSecurity rule blocking SQL metacharacters in uwp_sort_by
SecRule ARGS:uwp_sort_by "!@rx ^[a-zA-Z0-9_]+$" \
    "id:1006265,phase:2,deny,status:403,\
    msg:'CVE-2024-6265 UsersWP uwp_sort_by SQL injection attempt'"