CVE-2021-24731
📋 TL;DR
This SQL injection vulnerability in the Registration Forms WordPress plugin allows attackers to execute arbitrary SQL commands via the wp-json/pie/v1/login REST API endpoint. WordPress sites using vulnerable plugin versions are affected, potentially leading to data theft, modification, or complete system compromise.
💻 Affected Systems
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin
📦 What is this software?
Pie Register by Genetechsolutions
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including admin credential theft, arbitrary code execution via database functions, and full site takeover.
Likely Case
Data exfiltration of user information, privilege escalation, and backdoor installation.
If Mitigated
Limited impact if proper WAF rules block SQL injection patterns and database permissions are restricted.
🎯 Exploit Status
Exploit requires no authentication and uses standard SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.1.6
Vendor Advisory: https://wpscan.com/vulnerability/6bed00e4-b363-43b8-a392-d068d342151a
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Registration Forms' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 3.7.1.6+ from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable REST endpoint
allRemove or block access to the wp-json/pie/v1/login endpoint
# Add to .htaccess for Apache:
RewriteRule ^wp-json/pie/v1/login - [F,L]
# Add to nginx config:
location ~* ^/wp-json/pie/v1/login { deny all; }
Disable plugin
linuxTemporarily disable the Registration Forms plugin
wp plugin deactivate registration-forms
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
- Restrict database user permissions to SELECT only where possible
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed PluginsCheck Version:
wp plugin get registration-forms --field=versionVerify Fix Applied:
Confirm plugin version is 3.7.1.6 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts via wp-json/pie/v1/login
- UNION SELECT patterns in web server logs
Network Indicators:
- POST requests to /wp-json/pie/v1/login with SQL injection payloads
- Excessive requests to the vulnerable endpoint
SIEM Query:
source="web_server" AND uri="/wp-json/pie/v1/login" AND (payload="UNION" OR payload="SELECT" OR payload="FROM")