CVE-2024-13713

Executive Summary

CVE-2024-13713 is a critical SQL Injection vulnerability discovered in the WPExperts Square For GiveWP plugin for WordPress. This plugin integrates Square payment processing with the GiveWP donation system. The flaw resides in insufficient escaping of the post parameter and lack of prepared statements in the SQL query, allowing authenticated attackers with Subscriber-level access or higher to inject arbitrary SQL commands. Successful exploitation can lead to unauthorized extraction of sensitive data from the WordPress database, including user credentials, donation records, and other confidential information. The vulnerability affects all versions up to and including 1.3.1, and as of this report, no official patch has been released.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not available through NPM, PyPI, Go, or Ruby package managers. Therefore, supply chain risks are limited to WordPress site administrators who install this plugin directly. Users are advised to monitor the plugin’s official page for updates and consider temporary removal if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Subscriber-level access.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive data can be read.
• Integrity (I): None – Data cannot be modified.
• Availability (A): None – Service availability is not impacted.

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access reduces the immediate risk. However, the potential for data exfiltration makes it a serious concern for sites with untrusted users.

Deep Dive & Mechanics

The vulnerability exists in the WPExperts Square For GiveWP plugin, which handles Square payment transactions within the GiveWP donation system. The plugin fails to properly sanitize the post parameter before using it in an SQL query. Specifically, the code directly concatenates user input into the query without using parameterized statements or proper escaping.

Root Cause: The plugin uses a function that retrieves donation data based on the post parameter. The SQL query is built by directly appending the post value, allowing an attacker to inject SQL keywords and operators.

Attack Vector: An authenticated user with Subscriber-level privileges can craft a malicious HTTP request to a vulnerable endpoint (e.g., an AJAX handler or admin-ajax.php) that processes the post parameter. By injecting SQL syntax like ' OR 1=1 --, the attacker can manipulate the query to return unintended data.

Impact: Successful exploitation allows the attacker to extract sensitive information from the WordPress database, such as:

• User credentials (hashed passwords)
• Donation records (including donor names, email addresses, amounts)
• Payment transaction IDs
• Site configuration data

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on secure coding practices.

Vulnerable Code (Example):

$post_id = $_POST['post'];
$query = "SELECT * FROM wp_give_donations WHERE donation_id = " . $post_id;
$result = $wpdb->get_results($query);

Patched Code (Recommended):

$post_id = intval($_POST['post']);
$query = $wpdb->prepare("SELECT * FROM wp_give_donations WHERE donation_id = %d", $post_id);
$result = $wpdb->get_results($query);

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to parameterize the query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with WPExperts Square For GiveWP plugin version <= 1.3.1
• Valid user account with Subscriber role or higher
• Knowledge of the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with action give_square_process_donation)

Exploitation Steps:

1. Identify the vulnerable endpoint: Use browser developer tools or intercept proxy to find AJAX requests that include the post parameter.
2. Craft SQL injection payload: For example, post=1 UNION SELECT user_login, user_pass FROM wp_users--
3. Send malicious request:

   curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
   -d 'action=give_square_process_donation&post=1 UNION SELECT user_login, user_pass FROM wp_users--'
   

4. Extract data: The response will contain the injected data, allowing extraction of user credentials.

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual SQL errors: Look for database error logs containing SQL syntax errors or unexpected query patterns.
2. Analyze web server logs: Search for requests to admin-ajax.php with suspicious post parameter values containing SQL keywords (e.g., UNION, SELECT, OR).
3. Check user activity: Identify accounts with Subscriber role making repeated AJAX requests to the vulnerable endpoint.
4. Review database queries: Enable query logging in WordPress to capture all SQL queries and look for anomalies.

Mitigation:

• Temporarily disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Restrict Subscriber-level access to sensitive endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with parameter action=give_square_process_donation and post containing SQL keywords.
  • Unusual database error messages in logs (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified plugin files (e.g., wp-content/plugins/give-square/).
  • Suspicious entries in WordPress wp_options table.
• Behavioral IOCs:
  • Subscriber-level users accessing admin AJAX handlers.
  • Unexpected database queries returning multiple rows.

Detection Engineering

YARA Rule

rule CVE_2024_13713_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WPExperts Square For GiveWP plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13713"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "admin-ajax.php" nocase
        $sqli4 = "give_square_process_donation" nocase
    condition:
        any of ($sqli*) and #sqli3 > 0 and #sqli4 > 0
}

Sigma Rule

title: CVE-2024-13713 SQL Injection Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts against WPExperts Square For GiveWP plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=give_square_process_donation'
        cs-uri-query|contains|all:
            - 'post='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13713 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=give_square_process_donation"; http_client_body; pcre:"/post=.*(UNION|SELECT|OR\s+1=1)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: If the plugin is not critical, deactivate and delete it until a patch is released.
2. Apply virtual patching: Use a WAF to block requests containing SQL injection patterns in the post parameter.
3. Restrict user roles: Limit Subscriber-level access to AJAX endpoints by modifying WordPress capabilities.

Long-term Fix:

• Monitor the WPExperts plugin page for an official update.
• Once patched, update to the latest version immediately.
• Conduct a security audit of the plugin code to ensure no other vulnerabilities exist.

General Best Practices:

• Always use parameterized queries (prepared statements) in WordPress development.
• Implement input validation and sanitization for all user-supplied data.
• Regularly update all plugins and themes.
• Use a security plugin to monitor for suspicious activity.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert