CVE-2024-13781
📋 TL;DR
The Hero Maps Premium WordPress plugin contains a SQL injection vulnerability that allows authenticated attackers with Subscriber-level access or higher to execute arbitrary SQL queries. This can lead to unauthorized data extraction from the database, affecting all WordPress sites using vulnerable versions of this plugin.
💻 Affected Systems
- Hero Maps Premium WordPress Plugin
📦 What is this software?
Hero Maps Premium by Heroplugins
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of sensitive user data, administrative credentials, and potential privilege escalation to full site control.
Likely Case
Unauthorized access to sensitive information stored in the database such as user credentials, personal data, or site configuration.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, restricting attackers to data they already have access to.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once authentication is obtained. SQL injection vulnerabilities are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.0 or later
Vendor Advisory: https://codecanyon.net/item/hero-maps-premium-responsive-google-maps-plugin/12577151
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Hero Maps Premium. 4. Click 'Update Now' if update is available. 5. If no update appears, manually download version 2.4.0+ from CodeCanyon and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoints
allTemporarily disable the vulnerable AJAX actions by modifying WordPress functions.php or using a security plugin to block specific endpoints.
Add to theme's functions.php: remove_action('wp_ajax_hero_maps_action', 'vulnerable_function'); remove_action('wp_ajax_nopriv_hero_maps_action', 'vulnerable_function');
Web Application Firewall rule
linuxImplement WAF rules to block SQL injection patterns targeting Hero Maps plugin endpoints.
ModSecurity rule: SecRule REQUEST_URI "@contains wp-admin/admin-ajax.php" "chain,id:1001,phase:2,deny,status:403,msg:'Hero Maps SQLi attempt'" SecRule ARGS "@detectSQLi"
🧯 If You Can't Patch
- Immediately disable the Hero Maps Premium plugin if patching is not possible.
- Implement strict network segmentation to isolate the vulnerable WordPress instance from sensitive databases.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Hero Maps Premium. If version is 2.3.9 or lower, the system is vulnerable.Check Version:
wp plugin list --name=hero-maps-premium --field=versionVerify Fix Applied:
After updating, verify plugin version shows 2.4.0 or higher in WordPress admin plugins page.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs containing 'hero_maps' references
- Multiple failed authentication attempts followed by successful logins from same IP
- AJAX requests to wp-admin/admin-ajax.php with SQL keywords in parameters
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with SQL injection payloads
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (param="action" AND value="hero_maps*") AND (param="*" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|exec)")