CVE-2024-55972
Published: 16 December 2024
Summary
CVE-2024-55972 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-55972 is an SQL injection vulnerability (CWE-89) affecting the eTemplates WordPress plugin by chriscarvache. The flaw stems from improper neutralization of special elements in SQL commands and impacts all versions through 0.2.1. It carries a CVSS 3.1 score of 9.3, reflecting network attack vector, low complexity, no required privileges or user interaction, and changed scope with high confidentiality and limited availability impact.
Unauthenticated remote attackers can supply crafted input to trigger the injection, allowing them to read sensitive database contents and potentially disrupt service without any prior access or authentication to the WordPress site.
The sole reference points to a Patchstack advisory that catalogs the issue for the affected plugin versions; administrators should consult that entry for available updates or workarounds once released by the vendor.
EPSS currently sits at 0.1090 with no material post-disclosure climb from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52872
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.