CVE-2024-6666 Overview
CVE-2024-6666 is a SQL Injection vulnerability [CWE-89] affecting the WP ERP plugin for WordPress. The flaw exists in all versions up to and including 1.13.0. The vulnerability stems from insufficient escaping on the user-supplied vendor_id and status parameters and lack of sufficient preparation in the underlying SQL query. Authenticated attackers with Accounting Manager access (the erp_ac_view_sales_summary capability) or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database.
Critical Impact
Authenticated attackers with Accounting Manager privileges can inject arbitrary SQL to exfiltrate credentials, session tokens, and customer records from the WordPress database.
Affected Products
- WP ERP plugin for WordPress by wedevs
- All versions from initial release through 1.13.0
- Deployments exposing the accounting module to lower-tier managerial roles
Discovery Timeline
- 2024-07-11 - CVE-2024-6666 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6666
Vulnerability Analysis
The vulnerability resides in the accounting transactions logic of WP ERP, specifically within modules/accounting/includes/functions/transactions.php. The plugin builds SQL statements that concatenate the vendor_id and status request parameters directly into query strings. Because these parameters bypass proper escaping and prepared statement handling, an attacker can terminate the intended clause and append arbitrary SQL. Exploitation requires authentication and the erp_ac_view_sales_summary capability, which is granted to Accounting Manager and higher roles. Once inside the query context, an attacker can chain UNION-based or time-based payloads to enumerate tables, dump the wp_users table, and retrieve password hashes or session tokens. The impact extends to full compromise of the WordPress installation when hashes are cracked or administrator sessions are hijacked.
Root Cause
The root cause is missing input sanitization combined with unprepared SQL statements. WordPress provides the $wpdb->prepare() API for parameter binding, but the affected accounting functions concatenate request data into the query string. The vendor_id value is not cast to an integer, and the status value is not passed through esc_sql() or a placeholder.
Attack Vector
An authenticated user issues a crafted HTTP request to the sales summary endpoint. The attacker supplies a malicious value for vendor_id or status containing SQL metacharacters. The plugin interpolates the value directly into the accounting query executed against the WordPress database. Because the injection point sits inside a SELECT statement, UNION-based extraction is straightforward. Attackers can also use conditional time-based payloads to blind-exfiltrate data when responses are not directly reflected. Refer to the Wordfence Vulnerability Report for the parameter details and the WordPress Changeset Update for the corrected query construction.
Detection Methods for CVE-2024-6666
Indicators of Compromise
- HTTP requests to WP ERP accounting endpoints containing SQL metacharacters such as UNION, SLEEP(, --, or /* within vendor_id or status parameters
- Unexpected query strings referencing information_schema, wp_users, or wp_usermeta originating from authenticated Accounting Manager sessions
- Anomalous database read volume from the PHP worker processes serving the WP ERP module
Detection Strategies
- Deploy a web application firewall rule that inspects vendor_id for non-numeric characters and status for SQL keywords
- Enable MySQL general query logging temporarily and correlate suspicious SELECT patterns with the requesting user ID
- Review WordPress audit logs for Accounting Manager accounts issuing repeated requests to sales summary endpoints
Monitoring Recommendations
- Alert on outbound data spikes from the WordPress host that coincide with authenticated accounting sessions
- Monitor creation of new administrator accounts or unexpected changes to wp_options following accounting activity
- Track failed login attempts against WordPress after any suspected data exfiltration event to detect credential reuse
How to Mitigate CVE-2024-6666
Immediate Actions Required
- Upgrade WP ERP to version 1.13.1 or later on all WordPress installations running the plugin
- Audit users assigned the erp_ac_view_sales_summary capability and revoke access for accounts that do not require it
- Rotate WordPress administrator passwords and invalidate active sessions if any indicator of compromise is observed
Patch Information
The vendor released a fix in WP ERP 1.13.1. The patched code path in modules/accounting/includes/functions/transactions.php uses parameterized queries via $wpdb->prepare() for the vendor_id and status inputs. Apply the update through the WordPress plugin manager or by deploying the official changeset.
Workarounds
- Restrict access to the WordPress admin interface using IP allowlists at the reverse proxy or firewall until the plugin is patched
- Deploy a WAF signature that blocks SQL metacharacters in vendor_id and status parameters submitted to WP ERP endpoints
- Temporarily remove the erp_ac_view_sales_summary capability from all non-administrator roles
# Configuration example: update WP ERP via WP-CLI
wp plugin update erp --version=1.13.1
wp plugin verify-checksums erp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
