CVE-2024-0952 – This vulnerability allows authenticated attacke... (How to Fix)

Q: What is the severity of CVE-2024-0952?

CVE-2024-0952 has a CVSS score of 7.2 (HIGH). This vulnerability allows authenticated attackers with accounting manager or admin privileges in WordPress to perform time-based SQL injection attacks via the id parameter in the WP ERP plugin. Attackers can extract sensitive information from the database by injecting malicious SQL queries. Only WordPress sites using vulnerable versions of the WP ERP plugin are affected.

📋 TL;DR

This vulnerability allows authenticated attackers with accounting manager or admin privileges in WordPress to perform time-based SQL injection attacks via the id parameter in the WP ERP plugin. Attackers can extract sensitive information from the database by injecting malicious SQL queries. Only WordPress sites using vulnerable versions of the WP ERP plugin are affected.

💻 Affected Systems

Products:

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress

Versions: All versions up to and including 1.12.9

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with accounting manager or admin privileges. WordPress installation with vulnerable plugin version.

📦 What is this software?

Wp Erp by Wedevs

View all CVEs affecting Wp Erp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of sensitive user data, financial records, credentials, and potential privilege escalation to full system access.

🟠

Likely Case

Extraction of sensitive business data including customer information, financial records, and potentially credential harvesting from the WordPress database.

🟢

If Mitigated

Limited impact due to proper access controls, but still potential for data leakage from the database if exploited.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Time-based SQL injection requires authentication but is relatively straightforward to exploit with basic SQL injection knowledge.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.13.0

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3060269/erp/tags/1.13.0/modules/accounting/includes/functions/people.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WP ERP' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 1.13.0+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Remove vulnerable plugin

all

Temporarily disable or remove the WP ERP plugin until patched

wp plugin deactivate erp
wp plugin delete erp

Restrict user privileges

all

Temporarily remove accounting manager and admin privileges from untrusted users

🧯 If You Can't Patch

Implement strict network segmentation to isolate WordPress installation
Deploy web application firewall with SQL injection protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for WP ERP version 1.12.9 or lower

Check Version:

wp plugin get erp --field=version

Verify Fix Applied:

Verify WP ERP plugin version is 1.13.0 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual database queries with time delays
Multiple failed login attempts followed by SQL injection patterns
Unusual activity from accounting manager/admin accounts

Network Indicators:

SQL injection patterns in HTTP POST/GET parameters
Unusual database connection patterns from web server

SIEM Query:

source="web_logs" AND ("id=" AND ("sleep(" OR "waitfor" OR "benchmark(" OR pg_sleep))

📊 Metadata

CVE ID: CVE-2024-0952

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: April 9, 2024

Last Updated: January 30, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-0952, you might also want to check these: