CVE-2024-7349 Overview
CVE-2024-7349 is a blind SQL injection vulnerability in the LifterLMS WordPress plugin, a learning management system used for eLearning, online courses, and quizzes. The flaw exists in all versions up to and including 7.7.5 and stems from insufficient escaping of the order parameter combined with inadequate SQL query preparation. Authenticated attackers with administrator-level access or higher can append SQL statements to existing queries and extract sensitive database contents. The issue is tracked under CWE-89 and was patched in LifterLMS version 7.7.6.
Critical Impact
Authenticated administrators can exfiltrate arbitrary data from the WordPress database, including user credentials, session tokens, and course records, through blind SQL injection in the order parameter.
Affected Products
- LifterLMS plugin for WordPress, all versions through 7.7.5
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- WordPress sites using the vulnerable abstract.llms.database.query.php component
Discovery Timeline
- 2024-09-06 - CVE-2024-7349 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7349
Vulnerability Analysis
The vulnerability resides in the LifterLMS database abstraction layer, specifically in includes/abstracts/abstract.llms.database.query.php. The plugin accepts an order parameter from authenticated users and interpolates it into a SQL query without proper sanitization or use of prepared statements. Because the injection point is in an ORDER BY clause, standard union-based extraction is limited, so attackers rely on blind techniques such as boolean-based inference or time-based delays using SLEEP() or BENCHMARK().
Exploitation requires administrator credentials, which reduces broad opportunistic abuse. However, WordPress deployments with multiple privileged users, shared administrator accounts, or compromised admin sessions expose this attack surface. A successful exploit lets an attacker enumerate the schema and exfiltrate arbitrary rows from any table accessible to the WordPress database user, including wp_users password hashes and wp_usermeta session tokens.
Root Cause
The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The order parameter is concatenated into the query string rather than being validated against an allowlist of column names and sort directions. The plugin also does not use $wpdb->prepare() for the affected query, bypassing WordPress's standard parameterization defenses.
Attack Vector
The attack vector is network-based over authenticated HTTP requests to the WordPress admin interface. An attacker submits crafted values in the order parameter of a LifterLMS query, appending SQL fragments that alter query logic. Because the vulnerability is blind, attackers infer results by observing response differences or induced delays. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-7349
Indicators of Compromise
- HTTP requests to LifterLMS endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the order parameter
- Unusually long response times on LifterLMS admin pages, consistent with time-based blind SQL injection
- Access log entries showing repeated requests with incremental parameter changes from the same authenticated administrator session
- Unexpected database queries in MySQL slow query logs referencing LifterLMS tables
Detection Strategies
- Deploy a web application firewall rule to inspect the order parameter for SQL metacharacters and function names
- Enable WordPress database query logging and alert on queries containing suspicious ORDER BY clauses
- Monitor administrator account activity for anomalous query volumes or off-hours access patterns
Monitoring Recommendations
- Correlate WordPress access logs with database query logs to identify injection attempts and downstream data access
- Alert on privilege changes, new administrator accounts, or password hash reads following suspicious order parameter activity
- Track the installed LifterLMS version across WordPress fleets and flag any instance still running 7.7.5 or earlier
How to Mitigate CVE-2024-7349
Immediate Actions Required
- Upgrade LifterLMS to version 7.7.6 or later on all WordPress installations
- Audit all WordPress administrator accounts and rotate credentials for any account that could have accessed LifterLMS in the vulnerable window
- Review WordPress and database logs for indicators of injection attempts against the order parameter
Patch Information
The vendor released a fix in LifterLMS 7.7.6. The patch adjusts abstract.llms.database.query.php to properly sanitize the order parameter before it reaches the SQL query. Full details are available in the WordPress Changeset for LifterLMS.
Workarounds
- Restrict administrator role assignment to the minimum required personnel and enforce multi-factor authentication for all admin accounts
- Place the WordPress admin interface behind a web application firewall configured with SQL injection signatures
- Temporarily disable the LifterLMS plugin on sites that cannot be patched immediately
# Update LifterLMS via WP-CLI to the patched version
wp plugin update lifterlms --version=7.7.6
wp plugin list --name=lifterlms --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
