CVE-2024-13184

Vulnerability

Description

The Ultimate WordPress Toolkit – WP Extended plugin contains a time-based SQL injection vulnerability in its Login Attempts module. The root cause is insufficient escaping of a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. This affects all versions up to and including 3.0.12 [1].

Exploitation

Method

An unauthenticated attacker can exploit this flaw by sending specially crafted requests to the login functionality. Because the parameter is not properly sanitized and the query is not prepared, the attacker can inject SQL syntax that causes time delays, enabling blind injection techniques. No authentication is required, and the attack can be performed remotely over HTTP [1].

Impact

Successful exploitation allows the attacker to append additional SQL queries to the original query. This can be used to extract sensitive information from the WordPress database, such as user credentials, session tokens, or private content. Time-based SQL injection is slower but reliable for data exfiltration when direct output is not visible [1].

Mitigation

Users must update to a patched version of the plugin. The vendor has released a fix, and the vulnerability is addressed in versions after 3.0.12. No workaround is available; updating the plugin is the only known mitigation [1].