CVE-2024-9130 Overview
The GiveWP – Donation Plugin and Fundraising Platform for WordPress contains a time-based SQL Injection vulnerability affecting all versions up to and including 3.16.1. The flaw resides in the order parameter processed by class-give-donors-query.php under the plugin's Legacy View mode. Insufficient escaping of user input combined with improper SQL statement preparation allows authenticated attackers with GiveWP Manager-level access or higher to append arbitrary SQL to existing queries. Successful exploitation enables extraction of sensitive database contents, including donor records and WordPress credentials.
Critical Impact
Authenticated attackers with Manager-level access can execute time-based SQL Injection to exfiltrate database contents from affected WordPress installations.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
- All versions up to and including 3.16.1
- WordPress sites operating GiveWP in Legacy View mode
Discovery Timeline
- 2024-09-27 - CVE-2024-9130 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9130
Vulnerability Analysis
The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. It affects the donor query logic implemented in class-give-donors-query.php, which builds SQL statements using the order request parameter without adequate sanitization or parameter binding.
Attackers exploit the flaw via time-based blind SQL Injection. By injecting conditional expressions that trigger SLEEP() or comparable delay functions, an attacker infers database content one bit at a time based on server response latency. This technique bypasses the need for direct data reflection in the HTTP response.
Exploitation requires an authenticated session with GiveWP Manager role or higher. Once authenticated, the attacker submits crafted values in the order parameter of donor query requests handled in Legacy View mode. Successful queries can enumerate WordPress users, extract hashed passwords from wp_users, and read donor personally identifiable information.
Root Cause
The root cause is the direct concatenation of the user-supplied order parameter into the ORDER BY clause of the donor query. The plugin fails to whitelist acceptable ordering values and does not use prepared statements with $wpdb->prepare() for this portion of the query, leaving the SQL context open to injection.
Attack Vector
The attack vector is network-based over authenticated HTTP requests to WordPress admin endpoints that invoke the donor query. Because the required privilege is Manager-level, exploitation typically follows compromise of a lower-privileged account or insider abuse. The vulnerability requires no user interaction and results in confidentiality, integrity, and availability impact.
For technical details, review the WordPress Give Donors Query Code and the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-9130
Indicators of Compromise
- HTTP requests to donor query endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the order parameter.
- Anomalous latency in admin-ajax responses tied to GiveWP donor listing views.
- Database query logs showing malformed ORDER BY clauses referencing non-standard columns or subqueries.
- Unexpected reads against wp_users or GiveWP donor tables originating from the plugin's query path.
Detection Strategies
- Enable MySQL general query logging or slow query logging temporarily to capture ORDER BY payloads containing injected functions.
- Deploy a web application firewall rule that inspects the order request parameter for SQL syntax and delay functions.
- Alert on authenticated sessions from Manager-role accounts issuing repeated donor query requests within short intervals.
Monitoring Recommendations
- Baseline normal admin traffic patterns for GiveWP endpoints and alert on deviations in request volume or latency.
- Monitor WordPress audit logs for privilege changes granting Manager-level access to GiveWP.
- Review web server access logs for query strings containing URL-encoded SQL operators against admin endpoints.
How to Mitigate CVE-2024-9130
Immediate Actions Required
- Upgrade GiveWP to a version later than 3.16.1 that includes the fix from WordPress Changeset 3157829.
- Audit all WordPress accounts assigned the GiveWP Manager role or higher and revoke unnecessary privileges.
- Rotate credentials for any account that held Manager-level access during the exposure window.
Patch Information
The vendor addressed the flaw in the GiveWP plugin repository via WordPress Changeset 3157829, specifically modifying class-give-donors-query.php to properly validate the order parameter. Site administrators should update through the WordPress plugin manager or via WP-CLI immediately.
Workarounds
- Disable GiveWP Legacy View mode until the plugin is updated to remove the vulnerable code path.
- Restrict access to the WordPress admin interface using IP allowlisting or VPN gating to limit exposure.
- Reduce the number of accounts granted GiveWP Manager or higher roles as documented in the GiveWP User Roles Documentation.
# Update GiveWP using WP-CLI
wp plugin update give
wp plugin get give --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
