# CVE-2024-5057: Easy Digital Downloads - SQLi

> Live exploitation tracking for CVE-2024-5057 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-5057

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Easy Digital Downloads
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

## CrowdSec analysis

[CVE-2024-5057](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-5057) is a critical SQL injection vulnerability in Easy Digital Downloads versions up to 3.2.12, resulting from improper neutralization of special elements in SQL commands. This flaw allows remote, unauthenticated attackers to manipulate database queries, potentially exposing sensitive data and impacting the integrity and availability of affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2024-5057 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
In addition, according to the CrowdSec network, attack volume against CVE-2024-5057 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending crafted requests to `/wp-admin/admin-ajax.php` with the `action=edd_download_search` parameter, injecting SQL payloads via the `s` parameter to execute arbitrary SQL commands.

## Timeline

- 2024-08-29: CVE Published. CVE-2024-5057 is published to NVD.
- 2026-01-14: Rule Released. CrowdSec releases a rule to detect CVE-2024-5057 exploitation attempts against the CrowdSec Network.
- 2026-01-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-5057 for the first time.

## References

- https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-sql-injection-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5057.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-5057) follows observed exploitation activity for CVE-2024-5057. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.