WP Advanced Search SQLi (CVE-2024-9796)

The WordPress plugin WP Advanced Search (<= 3.3.9.2) is vulnerable to an unauthenticated SQL injection (CVE-2024-9796). One of its search parameters (used in the plugin's AJAX queries) is not sanitized, letting a session-less attacker extract data from the WordPress database, including the wp_users table with the phpass password hashes.

A public PoC dumps the user table:

python3 CVE-2024-9796.py    # -> users + $P$... hashes

The $P$ hashes are phpass; john or hashcat (mode 400) crack them with a wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt hashes

The recovered passwords often work for the WordPress panel and, through reuse, for FTP or SSH.

Nuances. The vulnerable version reaches 3.3.9.2; confirm the plugin and its version (with wpscan) before assuming exploitability. It is data-extraction SQLi, not RCE: the follow-up escalation depends on cracking the hashes or reusing credentials.

How to detect it. The signature is SQLi in the access log: unauthenticated requests to the plugin's AJAX endpoint (admin-ajax.php with the WP Advanced Search action) whose parameters contain SQL syntax (UNION SELECT, ' OR 1=1, SLEEP(, -- - comments). One source sending dozens of near-identical requests varying only in the payload is the sqlmap pattern, and any WAF with SQLi signatures flags it. Dumping wp_users shows as abnormally large responses or as queries hitting information_schema in the DB if auditing is on.

Defence. Update the plugin, use parameterized queries and strong, non-reused passwords. Related to blind SQLi, hash cracking and credential reuse.