CVE-2024-13507: 
WordPress vulnerability analysis and mitigation

CVE-2024-13507 is a time-based SQL Injection vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. It affects all versions up to and including 2.8.97, and was published on July 26, 2025. The flaw allows unauthenticated attackers to extract sensitive information from the WordPress database by appending malicious SQL queries via the dist parameter. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from insufficient escaping of the user-supplied dist parameter and inadequate preparation of the existing SQL query in the plugin's query class (includes/class-geodir-query.php, line 733). Because no authentication is required and the attack complexity is low, an unauthenticated remote attacker can craft HTTP requests that append time-based blind SQL payloads to the existing query, inferring database contents character by character through response timing differences. The vulnerable code path is publicly visible in the plugin's Trac repository (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to extract sensitive data from the WordPress database, including user credentials (hashed passwords), email addresses, API keys, and other configuration data stored in the database. The confidentiality impact is rated High, while integrity and availability are unaffected by this specific vector. Compromised credentials could enable follow-on attacks such as administrative account takeover and further lateral movement within the WordPress environment (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.089%, indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was assigned and disclosed by Wordfence (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the GeoDirectory plugin (version ≤ 2.8.97) using tools like WPScan, Shodan, or by checking /wp-content/plugins/geodirectory/ for version indicators.
2. Identify vulnerable endpoint: Locate a page or endpoint that invokes the GeoDirectory query functionality accepting the dist parameter (e.g., a business directory search page).
3. Craft time-based SQL payload: Append a time-based blind SQL injection payload to the dist parameter, such as 1 AND SLEEP(5)--, to confirm the injection point by observing delayed HTTP responses.
4. Extract data via blind injection: Use automated tools like sqlmap with time-based blind technique (--technique=T) targeting the dist parameter to enumerate databases, tables, and extract sensitive records (e.g., WordPress wp_users table for usernames and password hashes).
5. Leverage extracted credentials: Crack extracted password hashes offline or use them directly to authenticate to the WordPress admin panel for further access (Wordfence, WordPress Trac).

• Network: Unusual HTTP requests to GeoDirectory search or listing endpoints with the dist parameter containing SQL keywords (SLEEP, BENCHMARK, AND, OR, --) or encoded equivalents; repeated requests with incrementally varying dist values from a single IP.
• Logs: WordPress/web server access logs showing high volumes of requests to GeoDirectory endpoints with anomalous dist parameter values; requests resulting in delayed responses (indicative of SLEEP()-based payloads).
• Process/Database: Elevated database query execution times or unusual SLEEP() function calls appearing in MySQL slow query logs (/var/log/mysql/mysql-slow.log).

Users should update the GeoDirectory plugin to version 2.8.98 or later, which includes the fix applied in the changeset that properly escapes and prepares the dist parameter in SQL queries. The patch is available via the WordPress plugin repository. As an interim workaround, site administrators can disable the GeoDirectory plugin until the update can be applied, or implement a web application firewall (WAF) rule to block requests containing SQL injection patterns in the dist parameter (WordPress Trac Changeset, Wordfence).