CVE-2021-24460
📋 TL;DR
This SQL injection vulnerability in the Popup Like box WordPress plugin allows attackers to execute arbitrary SQL commands through the admin dashboard. It affects WordPress sites running vulnerable versions of this plugin, potentially compromising site data and server integrity.
💻 Affected Systems
- Popup Like box – Page Plugin for WordPress
📦 What is this software?
Popup Box by Ays Pro
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution on the server.
Likely Case
Unauthorized data access, modification of database content, and potential site defacement.
If Mitigated
Limited impact with proper input validation and database user privilege restrictions.
🎯 Exploit Status
Exploitation requires admin access but uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.3
Vendor Advisory: https://wpscan.com/vulnerability/9c0164f2-464b-4876-a48f-c0ebd63cf397
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Popup Like box – Page Plugin'. 4. Click 'Update Now' if available, or manually update to version 3.5.3 or later.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the plugin until patched
wp plugin deactivate popup-like-box
Apply input validation filter
allAdd custom validation for orderby parameter in theme functions
Add custom filter in functions.php to sanitize orderby parameter
🧯 If You Can't Patch
- Restrict admin dashboard access to trusted users only
- Implement web application firewall with SQL injection rules
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Installed PluginsCheck Version:
wp plugin get popup-like-box --field=versionVerify Fix Applied:
Confirm plugin version is 3.5.3 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Suspicious orderby parameter values in web server logs
Network Indicators:
- SQL error messages in HTTP responses
- Unusual database connection patterns
SIEM Query:
SELECT * FROM web_logs WHERE url LIKE '%orderby=%' AND (url LIKE '%SELECT%' OR url LIKE '%UNION%' OR url LIKE '%INSERT%')