CVE-2024-5756 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2024-5756?

CVE-2024-5756 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows unauthenticated attackers to perform time-based SQL injection attacks against the Email Subscribers WordPress plugin. Attackers can extract sensitive information from the database by injecting malicious SQL queries through the db parameter. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to perform time-based SQL injection attacks against the Email Subscribers WordPress plugin. Attackers can extract sensitive information from the database by injecting malicious SQL queries through the db parameter. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Email Subscribers by Icegram Express WordPress Plugin

Versions: All versions up to and including 5.7.23

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with the vulnerable plugin version are affected regardless of configuration.

📦 What is this software?

Icegram Express by Icegram

View all CVEs affecting Icegram Express →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of user credentials, personal data, email lists, and potentially WordPress admin credentials leading to full site takeover.

🟠

Likely Case

Extraction of email subscriber lists, user data, and potentially other sensitive information stored in the database.

🟢

If Mitigated

Limited information disclosure if database permissions are properly restricted and sensitive data is encrypted.

🌐 Internet-Facing: HIGH - The vulnerability is exploitable by unauthenticated attackers over the internet.

🏢 Internal Only: LOW - The vulnerability is internet-facing and doesn't require internal network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Time-based SQL injection requires more sophisticated exploitation than boolean-based but is still relatively straightforward for attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.7.24 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3101638/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Email Subscribers by Icegram Express'. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.7.24+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate email-subscribers

WAF Rule Implementation

all

Block SQL injection attempts targeting the db parameter

# Configure WAF to block requests containing SQL injection patterns in db parameter

🧯 If You Can't Patch

Implement a web application firewall (WAF) with SQL injection protection rules
Restrict database user permissions to limit potential data exposure

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Email Subscribers version. If version is 5.7.23 or lower, you are vulnerable.

Check Version:

wp plugin get email-subscribers --field=version

Verify Fix Applied:

Verify plugin version is 5.7.24 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual database queries with time delays
Multiple requests to plugin endpoints with SQL-like patterns in parameters
Database error logs showing SQL syntax errors

Network Indicators:

HTTP requests containing SQL keywords (SLEEP, WAITFOR, BENCHMARK) in db parameter
Unusual traffic patterns to plugin endpoints

SIEM Query:

source="web_logs" AND (uri_path="/wp-content/plugins/email-subscribers/" OR user_agent CONTAINS "Email Subscribers") AND (request_params CONTAINS "SLEEP" OR request_params CONTAINS "WAITFOR" OR request_params CONTAINS "BENCHMARK")

📊 Metadata

CVE ID: CVE-2024-5756

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: June 21, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-5756, you might also want to check these: