CVE-2024-49681
Published: 24 October 2024
Summary
CVE-2024-49681 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a SQL injection flaw, tracked as CWE-89, in the WP Sessions Time Monitoring Full Automatic plugin (activitytime) for WordPress. It affects all versions through 1.0.9 and stems from improper neutralization of special elements in SQL commands, carrying a CVSS 3.1 score of 9.3.
An unauthenticated attacker with network access can supply crafted input to trigger the injection. Successful exploitation allows extraction of sensitive data from the database with high confidentiality impact, limited availability effects, and scope change that can affect other components beyond the plugin itself.
The issue is documented in the Patchstack vulnerability database, which identifies the affected plugin versions and provides the technical details of the SQL injection vector. No explicit patch or mitigation guidance appears in the supplied references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43537
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows SQL Injection.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.0.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.