CVE-2024-7150: 10Web Slider WordPress SQLi Vulnerability

CVE-2024-7150 Overview

The Slider by 10Web – Responsive Image Slider plugin for WordPress contains a time-based SQL Injection vulnerability [CWE-89] in the id parameter. All versions up to and including 1.2.57 are affected. The flaw stems from insufficient escaping of user-supplied input and lack of proper preparation of the underlying SQL query in WDSModelSlider.php. Authenticated attackers with Contributor-level access or above can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets.

Critical Impact
Contributor-level authenticated attackers can execute arbitrary SQL statements against the WordPress database, exposing password hashes, API keys, and other sensitive stored data.

Affected Products

10Web Slider (slider-wd) plugin for WordPress
All versions up to and including 1.2.57
Fixed in the changeset published as version 1.2.58

Discovery Timeline

2024-08-08 - CVE-2024-7150 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7150

Vulnerability Analysis

The vulnerability resides in the WDSModelSlider.php file within the plugin's frontend model layer. The id parameter is passed directly into a SQL query without adequate escaping or use of parameterized queries via wpdb::prepare(). Because WordPress plugins execute SQL through the global $wpdb object, missing preparation exposes queries to string concatenation attacks. The injection is time-based blind, meaning the attacker infers database contents by observing response delays triggered through payloads such as SLEEP() or BENCHMARK() functions. Contributor role is the minimum required privilege, which is a common role assigned to guest authors and community contributors on WordPress sites, making the attack surface broad on multi-author sites.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The vulnerable code path accepts the id request parameter and interpolates it into a query string without casting to an integer or invoking wpdb::prepare() with a %d placeholder. Any Contributor-authenticated request can therefore inject arbitrary SQL fragments.

Attack Vector

Exploitation occurs over the network against the plugin's frontend endpoint. The attacker authenticates with at least Contributor privileges, then submits a crafted id parameter containing SQL payloads. Because the injection is blind and time-based, the attacker uses conditional SLEEP() calls to enumerate table names, column names, and row data one bit at a time. Automated tools such as sqlmap can perform this enumeration efficiently against the vulnerable endpoint.

No public proof-of-concept has been released. See the Wordfence Vulnerability Analysis and the vulnerable source in WDSModelSlider.php for technical context.

Detection Methods for CVE-2024-7150

Indicators of Compromise

HTTP requests to slider-wd frontend endpoints containing SLEEP(, BENCHMARK(, UNION SELECT, or encoded variants such as %20AND%20SLEEP inside the id parameter.
Unusually long response times, typically multiples of five or ten seconds, correlated with requests from a single authenticated Contributor account.
Database query logs showing malformed SELECT statements referencing plugin tables with concatenated conditional expressions.
New or dormant Contributor-role user accounts submitting repetitive requests to slider-related URLs.

Detection Strategies

Enable MySQL slow query logging and alert on queries originating from WordPress wp_options or wp_users tables exceeding a five-second threshold.
Deploy a web application firewall (WAF) rule that inspects the id parameter for SQL keywords and blocks requests containing time-delay functions.
Correlate authentication logs with request patterns to identify Contributor accounts sending high-volume parameter fuzzing traffic.

Monitoring Recommendations

Monitor WordPress wp-content/plugins/slider-wd/ traffic for anomalous parameter payloads and repeated request patterns.
Track outbound database query timing metrics and alert on statistical anomalies from PHP-FPM worker processes.
Review Contributor and Author role assignments monthly and audit any additions to lower-privileged roles.

How to Mitigate CVE-2024-7150

Immediate Actions Required

Update the Slider by 10Web plugin to a version later than 1.2.57 immediately through the WordPress plugin dashboard.
Audit all users with Contributor role or higher and revoke access for unused or suspicious accounts.
Rotate WordPress salts in wp-config.php, force password resets for all users, and rotate any API keys stored in wp_options.

Patch Information

The vendor fixed the vulnerability in changeset 3131688. The patch introduces proper input sanitization and parameterized queries. Administrators should verify the installed plugin version through the WordPress admin dashboard under Plugins, and confirm it is greater than 1.2.57. Refer to the plugin developers page for release notes.

Workarounds

If patching cannot be performed immediately, deactivate the Slider by 10Web plugin until the update is applied.
Restrict Contributor and Author role provisioning and require multi-factor authentication for all authenticated WordPress accounts.
Deploy WAF rules that block SQL keywords and time-delay functions in the id query parameter targeting slider-wd endpoints.

bash

# Example ModSecurity rule to block time-based SQLi against the slider-wd id parameter
SecRule ARGS:id "@rx (?i)(sleep|benchmark|union\s+select|information_schema)" \
  "id:1007150,phase:2,deny,status:403,\
  msg:'CVE-2024-7150 Slider by 10Web SQLi attempt',\
  tag:'application-multi',tag:'cwe-89'"