CVE-2024-3552 is a critical unauthenticated SQL injection in the Web Directory Free WordPress plugin, affecting versions before 1.7.0. A parameter reaches a SQL statement without sanitising or escaping through an AJAX action open to logged-out visitors. Update to 1.7.0 or later. Note that the record and WPScan score it differently.
Weakness class: CWE-89.
What's affected
- Product: Web Directory Free, a WordPress plugin by salephpscripts.
- Affected: all versions before 1.7.0.
- Fixed: 1.7.0, per the WPScan entry.
- Severity: the record says Critical, CVSS 9.8. The WPScan page lists the same CVE as High, CVSS 8.6. Both are reported here because they disagree. Either way, treat it as urgent since no login is needed.
- Exploited in the wild: the record's KEV flag is false.
How to check if you're exposed
- In the WordPress admin, open Plugins and read the version next to Web Directory Free.
- With WP-CLI, list the plugin and its version on each site using the command below.
wp plugin list | grep web-directory-free
- If you manage many sites, run the same command through your fleet tooling and filter for versions below 1.7.0.
- Check web server logs for unusual requests to the WordPress AJAX endpoint with long or oddly encoded parameters, and review the database for unexpected changes.
What to do now
- Update Web Directory Free to 1.7.0 or later on every site.
- If you cannot update today, deactivate the plugin until you can.
- Put a web application firewall rule in front of the AJAX endpoint as a stop gap, understanding it is not a fix.
- Review the database account the site uses. It should not have rights beyond the WordPress schema.
- Check for new administrator users, changed options and unexpected posts, since SQL injection can read and write data.
Why it matters
The weakness is CWE-89, SQL injection. User input becomes part of a query string instead of being passed as a bound parameter, so the database cannot tell data from instructions. The record names UNION, time-based and error-based techniques as possible, which are the standard ways to pull data out of a vulnerable query.
What lifts the score is exposure. The vulnerable AJAX action is available to unauthenticated users, so any visitor can reach it. WordPress databases hold password hashes, API keys in options tables and customer data, so a read primitive is already serious.
The fix for this class is the same everywhere: prepared statements with bound parameters. Plugins that call the database through wpdb prepare avoid the problem when used correctly. When you choose plugins, prefer ones with an active security record.
Quick check
Which version fixes CVE-2024-3552?
Version 1.7.0 of Web Directory Free, according to WPScan.
Why do the scores differ?
The record carries 9.8 Critical and WPScan lists 8.6 High. Scoring bodies weigh impact differently. Patch regardless.
Sources
Last reviewed: 19 October 2026.
