CVE-2024-1981 – CVE-2024-1981 is a critical SQL injection vulne... (How to Fix)

Q: What is the severity of CVE-2024-1981?

CVE-2024-1981 has a CVSS score of 9.8 (CRITICAL). CVE-2024-1981 is a critical SQL injection vulnerability in the WPvivid Backup and Migration WordPress plugin that allows unauthenticated attackers to execute arbitrary SQL queries. This enables attackers to extract sensitive data like user credentials, configuration details, and other database contents. All WordPress sites running the vulnerable plugin version are affected.

📋 TL;DR

CVE-2024-1981 is a critical SQL injection vulnerability in the WPvivid Backup and Migration WordPress plugin that allows unauthenticated attackers to execute arbitrary SQL queries. This enables attackers to extract sensitive data like user credentials, configuration details, and other database contents. All WordPress sites running the vulnerable plugin version are affected.

💻 Affected Systems

Products:

Migration, Backup, Staging – WPvivid plugin for WordPress

Versions: Version 0.9.68 and earlier

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with the vulnerable plugin version are affected regardless of configuration.

📦 What is this software?

Migration\, Backup\, Staging by Wpvivid

View all CVEs affecting Migration\, Backup\, Staging →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to credential theft, sensitive data exfiltration, privilege escalation, and potential site takeover.

🟠

Likely Case

Attackers extract administrative credentials, user data, and configuration information to gain unauthorized access.

🟢

If Mitigated

Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection via 'table_prefix' parameter requires minimal technical skill to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 0.9.69 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WPvivid Backup and Migration plugin. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the WPvivid plugin until patched

wp plugin deactivate wpvivid-backuprestore

Web Application Firewall rule

all

Block SQL injection patterns targeting the table_prefix parameter

Add WAF rule: Block requests containing SQL injection patterns in table_prefix parameter

🧯 If You Can't Patch

Implement strict input validation for all user-supplied parameters
Restrict database user permissions to minimum required privileges

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for WPvivid version

Check Version:

wp plugin get wpvivid-backuprestore --field=version

Verify Fix Applied:

Verify plugin version is 0.9.69 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts after SQL injection
Requests with SQL syntax in table_prefix parameter

Network Indicators:

HTTP POST requests containing SQL injection patterns
Unusual database connections from web server

SIEM Query:

source="web_logs" AND (table_prefix AND (SELECT OR UNION OR INSERT OR DELETE))

📊 Metadata

CVE ID: CVE-2024-1981

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: February 29, 2024

Last Updated: January 16, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-1981, you might also want to check these: