CVE-2024-50491
Published: 28 October 2024
Summary
CVE-2024-50491 is a critical-severity SQL Injection (CWE-89) vulnerability in Micahblu Rsvp Me. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-50491 is an SQL injection vulnerability (CWE-89) affecting the RSVP ME WordPress plugin in versions up to and including 1.9.9. The flaw stems from improper neutralization of special elements in SQL commands and carries a CVSS 3.1 score of 9.3, reflecting network-accessible exploitation with low attack complexity, no required privileges or user interaction, and changed scope.
Unauthenticated attackers can send crafted requests over the network to the vulnerable plugin component, enabling extraction of sensitive data from the database along with limited impact on availability. The high confidentiality impact and scope change allow an adversary to access information beyond the immediate application context.
The single referenced advisory from Patchstack documents the issue in the WordPress plugin database and points to the need for an update once a fixed version is released by the maintainer. The EPSS score has reached a peak of 0.4041 with a current value of 0.3774, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44917
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.