CVE-2024-2804 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection). 🔍 **Flaw**: Insufficient escaping of user-supplied parameters + lack of prepared statements in SQL queries. Specifically in `class-network-summary.php`.

Q: Who is affected? (Versions/Components)

📦 **Affected Product**: WordPress Plugin **Network Summary**. 🏢 **Vendor**: jokr. 📉 **Versions**: **2.0.11** and all earlier versions.

Q: What can hackers do? (Privileges/Data)

🕵️ **Attacker Capabilities**: Full SQL injection via the `category` parameter. 🔓 **Impact**: High risk of reading sensitive DB data, modifying records, or executing administrative commands on the database server.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Exploitation Threshold**: **LOW**. 📊 **CVSS**: 9.8 (Critical). 🔑 **Requirements**: No authentication (PR:N), Low complexity (AC:L), No user interaction (UI:N). Easily exploitable remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No specific PoC** listed in the provided data. 🌐 **References**: WordFence threat intel and WordPress Trac source code are available for analysis, but no ready-to-use exploit script is attached.

Q: How to self-check? (Features/Scanning)

🔎 **Self-Check Method**: 1. Scan for installed plugin **Network Summary**. 2. Verify version is **≤ 2.0.11**. 3. Check source code for SQL queries lacking `prepare()` or proper escaping in `class-network-summary.php`.

Q: Is it fixed officially? (Patch/Mitigation)

🔧 **Official Fix**: **Yes**. 📅 **Published**: 2024-04-09. ✅ **Action**: Update the plugin to the latest version immediately to patch the SQLi flaw.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. ⚠️ **Priority**: **P0**. 💡 **Reason**: CVSS 9.8, remote exploitability without auth, and direct database impact. Patch immediately!

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in WordPress Plugin 'Network Summary'.
💥 **Consequences**: Attackers can manipulate database queries via the `category` parameter.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection).
🔍 **Flaw**: Insufficient escaping of user-supplied parameters + lack of prepared statements in SQL queries. Specifically in `class-network-summary.php`.

Q3Who is affected? (Versions/Components)

📦 **Affected Product**: WordPress Plugin **Network Summary**.
🏢 **Vendor**: jokr.
📉 **Versions**: **2.0.11** and all earlier versions.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Capabilities**: Full SQL injection via the `category` parameter.
🔓 **Impact**: High risk of reading sensitive DB data, modifying records, or executing administrative commands on the database server.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Exploitation Threshold**: **LOW**.
📊 **CVSS**: 9.8 (Critical).
🔑 **Requirements**: No authentication (PR:N), Low complexity (AC:L), No user interaction (UI:N). Easily exploitable remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No specific PoC** listed in the provided data.
🌐 **References**: WordFence threat intel and WordPress Trac source code are available for analysis, but no ready-to-use exploit script is attached.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check Method**: 
Scan for installed plugin **Network Summary**.
Verify version is **≤ 2.0.11**.
Check source code for SQL queries lacking `prepare()` or proper escaping in `class-network-summary.php`.

Q8Is it fixed officially? (Patch/Mitigation)

🔧 **Official Fix**: **Yes**.
📅 **Published**: 2024-04-09.
✅ **Action**: Update the plugin to the latest version immediately to patch the SQLi flaw.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 
**Disable/Uninstall** the plugin if not needed.
Implement **WAF rules** to block SQL injection patterns in the `category` parameter.
…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**.
⚠️ **Priority**: **P0**.
💡 **Reason**: CVSS 9.8, remote exploitability without auth, and direct database impact. Patch immediately!

Continue exploring

Vulnerability detail Full AI analysis (login) jokr CWE-89