CVE-2024-8484: The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments…

PriorityP262high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

3.63%

88.1th percentile

The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
jianbo	rest_api_to_miniprogram	<= 4.7.1	—
xjb	rest_api_to_miniprogram	<= 4.7.1	—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-json/watch-life-net/v1/comment/getcomments↗

otherorder=[SQLi payload]↗

→Monitor unauthenticated HTTP requests to the REST API endpoint /wp-json/watch-life-net/v1/comment/getcomments, specifically inspecting the 'order' parameter for SQL injection payloads (e.g., appended UNION, SELECT, or stacked queries). ↗
→Flag requests where the 'order' parameter value contains SQL metacharacters or keywords (e.g., single quotes, UNION, SELECT, FROM, WHERE) against the getcomments endpoint, as the parameter lacks sufficient escaping and preparation. ↗
→No authentication is required to exploit this vulnerability; alert on any external/anonymous source querying /wp-json/watch-life-net/v1/comment/getcomments with a non-trivial 'order' parameter. ↗

·The vulnerability affects all versions of the REST API TO MiniProgram WordPress plugin up to and including 4.7.1. Ensure version-based detection or blocking rules are scoped accordingly. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.