CVE-2024-3552
CriticalPublic exploitWeb Directory Free <= 1.6.9 - Unauthenticated SQL Injection
Published Jun 14, 2024 · Updated Mar 25, 2025 · Also known as 2a6c5610-ed84-4d7d-a28f-d3807230e119
Key Facts
Patch immediately- CVE-2024-3552 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Web Directory Free (Salephpscripts).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 67% probability of exploitation in the next 30 days.
- Fixed versions are available, including Web Directory Free 1.7.0.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
67%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2024-3552 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Web Directory FreeSalephpscripts | See advisory | 1.7.0 |
Patched Releases
Web Directory Free
1.7.0
Timeline
Publicly disclosed
Jun 14, 2024
Last updated
Mar 25, 2025
Weakness Type
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
- advisoryhttps://plugins.trac.wordpress.org/browser/embedpress/tags/3.9.8/EmbedPress/Elementor/Widgets/Embedpress_Pdf.php#L705
- advisoryhttps://plugins.trac.wordpress.org/changeset/3072712/download-manager
- advisoryhttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3037767%40embedpress&new=3037767%40embedpress&sfp_email=&sfph_mail=#file1
- advisoryhttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3099922%40woolementor&new=3099922%40woolementor&sfp_email=&sfph_mail=
- advisoryhttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3101553%40easy-wp-smtp&new=3101553%40easy-wp-smtp&sfp_email=&sfph_mail=
FAQ
Common Questions.
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
Affected: Web Directory Free (Salephpscripts). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Web Directory Free 1.7.0.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-3552 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo