CVE-2021-24551
📋 TL;DR
This SQL injection vulnerability in the Edit Comments WordPress plugin allows attackers to execute arbitrary SQL commands on the database. It affects WordPress sites running Edit Comments plugin version 0.3 or earlier. Attackers can exploit this without authentication via the jal_edit_comments GET parameter.
💻 Affected Systems
- WordPress Edit Comments plugin
📦 What is this software?
Edit Comments by Edit Comments Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, and full site takeover.
Likely Case
Database information disclosure, data manipulation, and potential administrative access to WordPress.
If Mitigated
Limited impact with proper input validation, parameterized queries, and web application firewall rules in place.
🎯 Exploit Status
Simple SQL injection via GET parameter with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://wpscan.com/vulnerability/e62fb8db-384f-4384-ad24-e10eb9058ed5
Restart Required: No
Instructions:
1. Remove Edit Comments plugin completely. 2. No official patch exists - plugin appears abandoned. 3. Consider alternative comment management plugins.
🔧 Temporary Workarounds
Disable or Remove Plugin
allCompletely remove the vulnerable Edit Comments plugin from WordPress
wp plugin deactivate edit-comments
wp plugin delete edit-comments
Web Application Firewall Rule
allBlock requests containing suspicious SQL injection patterns targeting jal_edit_comments parameter
🧯 If You Can't Patch
- Implement strict input validation for all GET parameters
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Edit Comments plugin version. If version is 0.3 or earlier, you are vulnerable.Check Version:
wp plugin get edit-comments --field=versionVerify Fix Applied:
Verify plugin is completely removed from wp-content/plugins directory and no longer appears in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in WordPress logs
- Requests containing 'jal_edit_comments' parameter with SQL syntax
Network Indicators:
- HTTP GET requests with SQL injection payloads in jal_edit_comments parameter
SIEM Query:
http.uri contains "jal_edit_comments" AND (http.uri contains "UNION" OR http.uri contains "SELECT" OR http.uri contains "INSERT" OR http.uri contains "DELETE")