CVE-2017-14760
📋 TL;DR
This SQL injection vulnerability in Event Espresso Lite WordPress plugin allows attackers to execute arbitrary SQL commands through the recurrence_id parameter. WordPress sites using vulnerable plugin versions are affected, potentially leading to data theft, modification, or complete system compromise.
💻 Affected Systems
- Event Espresso Lite (WordPress plugin)
📦 What is this software?
Event Espresso Lite by Eventespresso
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, and full website takeover.
Likely Case
Database information disclosure, user data theft, and potential administrative access to WordPress.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
SQL injection via recurrence_id parameter is straightforward. Requires some WordPress access level to reach admin.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.37.13 or later
Vendor Advisory: https://wordpress.org/plugins/event-espresso-free/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Event Espresso Lite. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Temporary Access Restriction
allRestrict access to /wp-admin/admin.php endpoint using web server rules or WAF.
# Apache: RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin\.php$
RewriteRule .* - [F,L]
# Nginx: location ~ ^/wp-admin/admin\.php$ { deny all; }
🧯 If You Can't Patch
- Disable Event Espresso Lite plugin immediately
- Implement web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Event Espresso Lite version. If version is 3.1.37.12.L or earlier, system is vulnerable.Check Version:
wp plugin list --name=event-espresso-free --field=versionVerify Fix Applied:
Confirm plugin version is 3.1.37.13 or later. Test admin.php endpoint with SQL injection payloads to verify protection.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to wp-admin
- Admin.php access with suspicious recurrence_id parameters
Network Indicators:
- HTTP POST/GET requests to /wp-admin/admin.php with SQL injection patterns in recurrence_id
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin.php" AND (recurrence_id CONTAINS "'" OR recurrence_id CONTAINS "--" OR recurrence_id CONTAINS ";")