CVE-2024-3067 – The WooCommerce Google Feed Manager plugin for ... (How to Fix)

Q: What is the severity of CVE-2024-3067?

CVE-2024-3067 has a CVSS score of 7.2 (HIGH). The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL injection via the 'id' parameter. This allows authenticated attackers with administrator access to execute arbitrary SQL queries to extract sensitive database information, and unauthenticated attackers can inject malicious web scripts. All WordPress sites using this plugin up to version 2.4.2 are affected.

📋 TL;DR

The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL injection via the 'id' parameter. This allows authenticated attackers with administrator access to execute arbitrary SQL queries to extract sensitive database information, and unauthenticated attackers can inject malicious web scripts. All WordPress sites using this plugin up to version 2.4.2 are affected.

💻 Affected Systems

Products:

WooCommerce Google Feed Manager (WordPress plugin)

Versions: All versions up to and including 2.4.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with WooCommerce installed. The plugin must be active and accessible.

📦 What is this software?

Woocommerce Google Feed Manager by Wpmarketingrobot

View all CVEs affecting Woocommerce Google Feed Manager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including user credentials, payment information, and site takeover through privilege escalation or remote code execution.

🟠

Likely Case

Data exfiltration of sensitive information like user data, product information, and configuration details.

🟢

If Mitigated

Limited impact with proper input validation, parameterized queries, and least privilege access controls in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection vulnerabilities are commonly exploited. The 'id' parameter manipulation is straightforward for attackers with basic SQL knowledge.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3070663%40wp-product-feed-manager&new=3070663%40wp-product-feed-manager&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'WooCommerce Google Feed Manager'. 4. Click 'Update Now' if available, or download version 2.4.3+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the WooCommerce Google Feed Manager plugin until patched

wp plugin deactivate wp-product-feed-manager

Web Application Firewall rule

all

Block SQL injection patterns targeting the 'id' parameter

Modify WAF to block requests with SQL patterns in 'id' parameter

🧯 If You Can't Patch

Implement strict input validation and sanitization for all user inputs
Apply principle of least privilege to database user accounts

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for WooCommerce Google Feed Manager version 2.4.2 or lower

Check Version:

wp plugin get wp-product-feed-manager --field=version

Verify Fix Applied:

Confirm plugin version is 2.4.3 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts followed by successful admin access
Unexpected database schema changes

Network Indicators:

HTTP requests with SQL injection patterns in 'id' parameter
Unusual outbound database connections

SIEM Query:

source="web_logs" AND (id=* OR id LIKE "%'%" OR id LIKE "%--%" OR id LIKE "%UNION%" OR id LIKE "%SELECT%")

📊 Metadata

CVE ID: CVE-2024-3067

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: April 16, 2024

Last Updated: March 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3067, you might also want to check these: