CVE-2024-7385 is a SQL injection flaw in the WP Simple HTML Sitemap plugin for WordPress. It is rated Critical (CVSS 9.1) and affects all versions up to and including 3.1. It needs an Administrator account to use. Update the plugin to a release newer than 3.1.
What's affected
The NVD record says the plugin is vulnerable to SQL injection through the id parameter in all versions up to and including 3.1. The record gives the cause as insufficient escaping of the user supplied parameter and a lack of preparation on the existing SQL query. It says authenticated attackers with Administrator level access and above can append extra SQL to existing queries and use that to extract sensitive information from the database.
The record's references include the vulnerable code in tag 3.1 (the file inc/wshs_saved.php), a later changeset to the same file in trunk (3155037), and a Wordfence entry. I could not load the Wordfence page or the changeset, so I did not confirm the first patched version from a page I read. The WordPress.org plugin API currently reports version 3.9 as the latest release, which is above the affected range. Confirm the exact first fixed version on the plugin's page before recording it in a ticket.
There is a point about the score worth stating plainly. The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The Critical rating comes from a changed scope and high impact on all three areas. Yet the requirement for high privileges lowers real world exposure. An attacker first needs an administrator account.
How to check if you're exposed
On each site, run WP-CLI.
wp plugin list --name=wp-simple-html-sitemap --fields=name,status,version
A version of 3.1 or lower is in range. You can also read the version in the Plugins screen of the admin dashboard. If you manage many sites, collect the same output from all of them.
Next, list who holds the Administrator role.
wp user list --role=administrator --fields=ID,user_login,user_registered
Look for accounts you do not recognize, and for administrator accounts shared between several people.
What to do now
- Update WP Simple HTML Sitemap to the latest version from WordPress.org, and confirm it is above 3.1.
- If you do not use the sitemap feature, remove the plugin instead of leaving it deactivated on disk.
- Review administrator accounts, remove unused ones, and enforce strong passwords and two factor sign in.
- Check your database user's rights. A WordPress database account that can only touch its own database limits what a SQL flaw can reach.
- Scan your sites and plugins for known issues with the free tool at gold.safeguard.sh/scan.
Why it matters
The weakness is CWE-89, SQL injection. The plugin builds a database query with a request value that is not escaped and not passed as a parameter, so part of the value is read as SQL. The standard defense is a prepared statement, in which the query shape is fixed and the value is passed separately. The record describes exactly this missing preparation.
The administrator requirement is a useful reminder that privilege boundaries inside WordPress are thinner than they look. An administrator can already do much on a site, but direct database access is a different level, since the database may hold data from other plugins and user records. The record does not carry a KEV flag, and I found no report of exploitation in what I read.
Quick check
Can an anonymous visitor exploit CVE-2024-7385?
Not according to the record. It says authenticated attackers with Administrator level access and above can exploit it.
Why is it Critical if an admin is required?
The CVSS score of 9.1 counts a changed scope and high impact on confidentiality, integrity and availability. The privilege requirement lowers likelihood, not the score ceiling, so plan with both in mind.
Sources
Last reviewed: 19 October 2026.
