CVE-2024-32139
Published: 15 April 2024
Summary
CVE-2024-32139 is a high-severity SQL Injection (CWE-89) vulnerability in Podlove Podlove Podcast Publisher. Its CVSS base score is 8.5 (High).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-32139 is an SQL injection issue (CWE-89) in the Podlove Podcast Publisher plugin for WordPress. It affects versions from n/a through 4.0.12 and is rated 8.5 on CVSS 3.1 with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L.
An authenticated attacker with low privileges can send crafted requests over the network to inject arbitrary SQL commands, achieving high-impact disclosure of sensitive data and limited availability effects within the WordPress environment due to the changed scope.
References hosted by Patchstack record the details of the flaw and are the primary public advisories available for this CVE.
The associated EPSS score has remained flat at 0.0730 with no material upward trajectory observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29960
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.12.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.