CVE-2024-5057
Published: 29 August 2024
Summary
CVE-2024-5057 is a critical-severity SQL Injection (CWE-89) vulnerability in Awesomemotive Easy Digital Downloads. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-5057 is a SQL injection vulnerability (CWE-89) affecting the Easy Digital Downloads WordPress plugin in all versions through 3.2.12. The flaw stems from improper neutralization of special elements in SQL commands and carries a CVSS 3.1 score of 9.3, reflecting network attack vector, low complexity, no required privileges or user interaction, and changed scope with high confidentiality impact plus limited availability consequences.
An unauthenticated remote attacker can supply crafted input to trigger arbitrary SQL queries against the underlying database. Successful exploitation may allow extraction of sensitive data stored by the plugin and limited disruption of service availability, with the changed scope indicating potential effects beyond the immediate component.
The sole reference points to a Patchstack advisory entry that catalogs the issue and affected versions; no explicit patch or mitigation steps are detailed in the provided data. The associated EPSS score reached a peak of 0.6449 before settling at the current value of 0.5499.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46321
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.