CVE-2024-1118 is a High severity SQL injection, scored 8.8, in the Podlove Subscribe Button plugin for WordPress. Versions up to and including 1.3.10 are affected. Attackers need at least contributor level access. Update to a release after 1.3.10 and review who holds that role.
What's affected
The record lists Podlove Subscribe Button up to and including 1.3.10. The button attribute of the podlove-subscribe-button shortcode is not escaped properly and the existing SQL query is not prepared. The result is UNION based SQL injection by authenticated users with contributor access or higher.
The record names no fixed version. It references a commit in the plugin's GitHub repository and a WordPress changeset, but I could not confirm the release number from them. Read the changelog for the first release after 1.3.10.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under Podlove Subscribe Button. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- Find sites using the plugin and read the version.
- Update to a release newer than 1.3.10 and confirm that the changelog mentions the fix.
- Review accounts with contributor role or higher and remove those you do not need.
- Search for posts that use the shortcode with unusual
buttonvalues, which may show attempted abuse. - If you cannot update, deactivate the plugin.
Why it matters
The class is SQL injection, CWE-89. The attribute comes from a post author, who is trusted to write content but not to run database queries. The UNION technique lets an attacker add their own query and read other tables.
Contributor access is a low bar on sites with open registration or many authors, and database contents include password hashes. The score is 8.8 because exploitation is simple once the account exists. The record's KEV flag is false.
Quick check
Who can exploit this?
Authenticated users with contributor level access or above, per the record.
Is there a code fix I can inspect?
The record references a commit in the plugin's GitHub repository, which you can read to see the change.
Sources
- Plugin commit on GitHub, referenced in the record
- Wordfence advisory (Wordfence advisory, page body could not be read when fetched)
- NVD record and references for CVE-2024-1118
Last reviewed: 19 October 2026.
