Critical SQL Injection Vulnerability Discovered in WordPress LayerSlider Plugin Affecting Over One Million Sites

A critical security vulnerability has been disclosed in LayerSlider, one of the most widely used WordPress plugins, putting over one million websites at risk of database compromise. The flaw, cataloged as CVE-2024-2879, carries a maximum severity rating of 9.8 out of 10 on the CVSS 3.0 scale, underscoring the urgency of the threat facing the broader web ecosystem.

The Exploit Mechanics

The vulnerability resides in the ls_get_popup_markup action within LayerSlider versions 7.9.11 and 7.10.0. Security researcher AmrAwad, operating under the handle 1337_Wannabe, identified that the plugin fails to properly sanitize the id parameter before passing it to the find() function in the LS_Sliders class. When the parameter receives a non-numeric value, the application constructs SQL queries without employing the prepare() function, which is the standard WordPress defense against injection attacks.

Attackers exploit this weakness using a time-based blind SQL injection technique. By crafting malicious requests that embed SQL CASE statements alongside the MySQL SLEEP() command, adversaries can observe response timing differences to systematically extract sensitive data from the underlying database. This method allows retrieval of password hashes, user credentials, and other confidential information stored in the WordPress database.

Affected Systems

LayerSlider, developed by the Kreatura Team, is a premium slider plugin bundled with many popular WordPress themes. Given that WordPress powers approximately 43% of all websites on the internet, the attack surface is enormous. Any site running the vulnerable versions that has not yet applied the patch remains exposed to unauthenticated attackers, meaning no administrative privileges are required to initiate an attack.

Crypto-related websites built on WordPress are particularly attractive targets. Exchanges, news platforms, wallet services, and DeFi dashboards running the plugin could potentially leak user data, API keys, or administrative credentials if exploited. With Bitcoin trading at approximately $67,837 and the broader crypto market capitalization exceeding $2.5 trillion, the financial incentive for attackers to compromise these platforms is substantial.

The Mitigation Strategy

Wordfence, the WordPress security firm that facilitated the disclosure, awarded AmrAwad a $5,500 bounty for the discovery, marking their highest bounty payout to date. Following responsible disclosure protocols, Wordfence notified the Kreatura Team, who responded promptly by releasing a patch in version 7.10.1 on March 27, approximately one week before public disclosure.

Site administrators should immediately update LayerSlider to version 7.10.1 or later. For those unable to update immediately, implementing a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns targeting the ls_get_popup_markup endpoint provides temporary protection. Additionally, restricting direct access to WordPress AJAX endpoints through server-level configuration can reduce the attack surface.

Lessons Learned

This incident highlights several critical principles for the crypto and web development community. First, the practice of bundling third-party plugins with themes creates hidden dependencies that site owners may not even be aware of. Many administrators running LayerSlider may not have realized the plugin was active on their installations. Second, the vulnerability demonstrates that even well-established, commercially successful plugins with over a million installations can harbor critical flaws. The WordPress ecosystem’s reliance on the prepare() function for SQL safety means that a single oversight in parameter handling can open the door to catastrophic data breaches.

User Action Required

If you operate a WordPress-based crypto platform, take immediate action. Update all plugins, especially LayerSlider, to their latest versions. Conduct a security audit of your database for signs of unauthorized access. Enable two-factor authentication for all administrative accounts. Consider deploying runtime application self-protection tools that monitor SQL query patterns in real time. For crypto exchanges and wallet services, this is also an opportune moment to verify that customer-facing infrastructure is isolated from content management systems that might run vulnerable plugins.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified cybersecurity professionals for site-specific recommendations.