Security readout for executives and security teams
Plain-English summary
Astra Pro Addon for WordPress before 3.5.2 allowed improperly handled AJAX input to reach SQL queries. Because the affected actions were reachable without login, a public website using a vulnerable version could expose database data or integrity risks typical of SQL injection.
Executive priority
Treat this as urgent for public WordPress sites because unauthenticated SQL injection can threaten customer data and site integrity. Patch or disable vulnerable plugin versions promptly, then review logs for suspicious activity.
Technical view
CVE-2021-24507 is CWE-89 in Astra Pro Addon before 3.5.2. POST parameters for astra_pagination_infinite and astra_shop_pagination_infinite were not properly sanitized or escaped before SQL use. The source bundle gives no CVSS score and does not show KEV listing.
Likely exposure
Exposure is most likely on WordPress sites running Astra Pro Addon below 3.5.2, especially internet-facing stores or sites using infinite pagination features. The vendor and WPScan references should be used to confirm exact fixed version status.
Exploitation context
The source bundle supports unauthenticated reachability but does not support active exploitation. CISA KEV status is false, and no cited source in the bundle confirms exploitation in the wild.
Researcher notes
The record identifies affected AJAX actions and unsanitized POST parameters, but the bundle does not include payload details, CVSS scoring, or confirmed exploitation. Avoid assuming broader Astra theme exposure beyond Astra Pro Addon.
Mitigation direction
- Upgrade Astra Pro Addon to version 3.5.2 or later.
- If upgrade is delayed, disable the plugin until vendor guidance is applied.
- Check vendor changelog and WPScan entry for current remediation details.
- Prioritize internet-facing WordPress sites and ecommerce deployments first.
Validation and detection
- Inventory all WordPress sites using Astra Pro Addon.
- Confirm installed Astra Pro Addon version is 3.5.2 or later.
- Review web logs for requests involving the affected AJAX action names.
- Check database logs for unusual query errors around affected request times.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24507 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/a1a0dc0b-c351-4d46-ac9b-b297ce4d251cCVE reference · x_refsource_MISC
- https://wpastra.com/changelog/astra-pro-addon/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.