CVE-2024-8484: Rest API To MiniProgram SQLi Vulnerability

CVE-2024-8484 Overview

CVE-2024-8484 is an unauthenticated SQL Injection vulnerability in the REST API TO MiniProgram plugin for WordPress, developed by jianbo. The flaw exists in the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint, where the order parameter is incorporated into a SQL query without sufficient escaping or prepared statement use. All plugin versions up to and including 4.7.1 are affected. Unauthenticated attackers can append additional SQL queries to extract sensitive data from the WordPress database, including user credentials and session tokens. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from affected WordPress sites by injecting SQL via the order parameter of a public REST endpoint.

Affected Products

Jianbo REST API TO MiniProgram plugin for WordPress, all versions through 4.7.1
WordPress sites exposing the /wp-json/watch-life-net/v1/comment/getcomments endpoint
File: includes/api/ram-rest-comments-controller.php

Discovery Timeline

2024-09-25 - CVE-2024-8484 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8484

Vulnerability Analysis

The vulnerability resides in the comments REST controller of the REST API TO MiniProgram plugin. The endpoint /wp-json/watch-life-net/v1/comment/getcomments accepts an order parameter from the request and concatenates it directly into an SQL query executed against the WordPress database. The plugin neither escapes the user-supplied value nor uses $wpdb->prepare() with proper placeholders for the ORDER BY clause. Because the endpoint does not require authentication, any remote actor able to reach the WordPress site can submit crafted values to the parameter. Successful exploitation returns query results in the API response, enabling data extraction through UNION-based or time-based blind techniques. The Exploit Prediction Scoring System places this issue in the 88th percentile, indicating elevated likelihood of opportunistic exploitation.

Root Cause

The root cause is improper neutralization of input used in a SQL command [CWE-89]. The order parameter is interpolated into the query string used to fetch comments, and ORDER BY clauses cannot be parameterized using standard placeholders. Instead of validating the value against an allowlist of column names and directions (ASC/DESC), the plugin trusts the request input.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP GET or POST request to the vulnerable REST route with a malicious order value. The crafted payload terminates the legitimate clause and appends a secondary query such as a UNION SELECT against wp_users to retrieve user_login and user_pass hashes. Time-based techniques using SLEEP() can be used when responses are not directly reflected. See the Wordfence Vulnerability Report and the vulnerable source line for technical context.

Detection Methods for CVE-2024-8484

Indicators of Compromise

HTTP requests to /wp-json/watch-life-net/v1/comment/getcomments containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or INFORMATION_SCHEMA in the order parameter.
Unusually long or URL-encoded values in the order query parameter from external IP addresses.
Web server access logs showing repeated probing of the watch-life-net/v1/comment route from a single source.
Database error messages referencing ORDER BY syntax appearing in PHP error logs.

Detection Strategies

Deploy a web application firewall rule that inspects the order parameter on the affected REST route and blocks SQL metacharacters.
Monitor WordPress REST API traffic for anomalous response sizes or latency on getcomments requests, which may indicate UNION-based or time-based injection.
Correlate wp-json access patterns with subsequent administrator account logins from new IP addresses.

Monitoring Recommendations

Enable verbose access logging for all /wp-json/ endpoints and forward logs to centralized analytics for review.
Alert on outbound requests from the WordPress host immediately following suspicious REST API calls, which may indicate data exfiltration.
Track plugin version inventory across hosted WordPress sites to identify instances still running 4.7.1 or earlier.

How to Mitigate CVE-2024-8484

Immediate Actions Required

Update the REST API TO MiniProgram plugin to a version newer than 4.7.1 that contains the fix introduced in WordPress Changeset #3337740.
If a patched release is unavailable in your environment, deactivate and remove the plugin until it can be upgraded.
Rotate WordPress administrator passwords, API keys, and secrets stored in wp_options after confirming whether exploitation occurred.
Audit wp_users for unauthorized accounts or modified password hashes.

Patch Information

The vendor addressed the issue in the changeset referenced by WordPress Changeset #3337740, which corrects the handling of the order parameter in ram-rest-comments-controller.php. Site operators should install the fixed release from the WordPress plugin repository and validate that the installed version is later than 4.7.1.

Workarounds

Block external access to /wp-json/watch-life-net/v1/comment/getcomments at the web server or WAF until the plugin is patched.
Restrict the WordPress REST API to authenticated users via a security plugin or custom rest_authentication_errors filter.
Enforce least-privilege database credentials for WordPress so the application account cannot read sensitive tables beyond what it requires.

bash

# Example nginx rule to block the vulnerable endpoint until patched
location ~* /wp-json/watch-life-net/v1/comment/getcomments {
    return 403;
}