CVE-2024-5765: The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action…

PriorityP178critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

27.43%

97.8th percentile

The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected

1 ranges

Vendor	Product	Version range	Fixed in
a17lab	wpstickybar	<= 2.1.0	—

Detection & IOCsextracted from sources · hover to see the quote

sigma

title: WpStickyBar SQLi Detection
condition: and
filter:
  - 'status_code == 200'
  - 'contains(content_type, "text/html")'

bytes

490a0046304402207d234cdfb2229b7d31190800f5fa203c72b0f41b31c8a92deea1f108aa576a79022027e8c86acf5729e92ea01a16804b3122265cf9f6fbe791c2f48fca0858c32d18:922c64590222798bb761d5b6d8e72950

→The vulnerability is exploitable by unauthenticated users via an AJAX action; monitor WordPress AJAX endpoints (wp-admin/admin-ajax.php) for SQL injection patterns targeting WpStickyBar plugin parameters. ↗
→Flag requests where the WpStickyBar plugin version is 2.1.0 or below, particularly AJAX calls with unsanitized parameters that may contain SQL metacharacters (quotes, UNION, SELECT, etc.). ↗

·The nuclei/detection template digest is provided but the source URL is missing; the template's full condition logic (version check <=6, status_code 200, text/html content-type) should be validated against the actual plugin AJAX endpoint before deployment.

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.