CVE-2024-12635
📋 TL;DR
The WP Docs WordPress plugin contains a time-based SQL injection vulnerability in the 'dir_id' parameter that allows authenticated attackers with Subscriber-level access or higher to extract sensitive database information. The vulnerability affects all versions up to and including 2.2.0 due to insufficient input sanitization and lack of prepared statements. Attackers can exploit this to steal sensitive data including user credentials, configuration details, and other database contents.
💻 Affected Systems
- WP Docs WordPress Plugin
📦 What is this software?
Wp Docs by Androidbubble
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, sensitive data exfiltration, privilege escalation, and potential site takeover.
Likely Case
Extraction of sensitive user data, configuration information, and potentially authentication credentials from the database.
If Mitigated
Limited data exposure if proper input validation and prepared statements are implemented, with minimal impact on site functionality.
🎯 Exploit Status
Exploitation requires authenticated access but uses standard SQL injection techniques. Time-based attacks make detection more difficult.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2.2.0 (check for latest update)
Vendor Advisory: https://plugins.trac.wordpress.org/browser/wp-docs
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WP Docs plugin
4. Click 'Update Now' if update available
5. If no update available, deactivate and remove plugin
6. Check for updated version on WordPress plugin repository
🔧 Temporary Workarounds
Disable WP Docs Plugin
allTemporarily disable the vulnerable plugin until patched version is available
wp plugin deactivate wp-docs
Restrict User Registration
allTemporarily disable new user registration to limit attack surface
update wp_options set option_value = '0' where option_name = 'users_can_register'
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with SQL injection rules
- Restrict plugin access to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WP Docs version. If version is 2.2.0 or earlier, you are vulnerable.Check Version:
wp plugin get wp-docs --field=versionVerify Fix Applied:
Verify WP Docs plugin version is higher than 2.2.0 and check plugin changelog for SQL injection fixes.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries with time delays
- Multiple failed authentication attempts followed by SQL queries
- Abnormal 'dir_id' parameter values in requests
Network Indicators:
- Repeated requests with varying 'dir_id' parameters
- Requests with SQL syntax in parameters
- Unusual timing patterns in responses
SIEM Query:
source="web_logs" AND ("dir_id" AND (SLEEP OR WAITFOR OR BENCHMARK))