CVE-2024-43965
Published: 29 August 2024
Summary
CVE-2024-43965 is a high-severity SQL Injection (CWE-89) vulnerability in Smackcoders Sendgrid. Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-43965 is an SQL injection vulnerability arising from improper neutralization of special elements used in SQL commands, classified under CWE-89. It affects the SendGrid for WordPress plugin by Smackcoders, impacting all versions through 1.4.
The flaw can be exploited remotely over a network by unauthenticated attackers who must induce user interaction, such as through a crafted request. Successful exploitation yields a CVSS 8.2 impact with changed scope, resulting in high confidentiality exposure and limited availability effects on components beyond the plugin itself.
Patchstack maintains a public database entry for the issue at https://patchstack.com/database/vulnerability/wp-sendgrid-mailer/wordpress-sendgrid-for-wordpress-plugin-1-4-sql-injection-vulnerability?_s_id=cve. The current EPSS score of 0.1843, with a recorded peak of 0.2087, indicates moderate and sustained exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40614
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.