CVE-2024-55976
Published: 16 December 2024
Summary
CVE-2024-55976 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-55976 is an SQL injection flaw (CWE-89) in the Critical Site Intel WordPress plugin, specifically the critical-site-intel-stats component authored by mikeleembruggen. It affects all versions through 1.0 and is rated 9.3 under CVSS 3.1, driven by network attack vector, low complexity, no required privileges or user interaction, and changed scope.
Unauthenticated remote attackers can supply crafted input to execute arbitrary SQL commands against the underlying database. Successful exploitation yields high-impact confidentiality breaches, limited availability effects, and potential compromise of additional application components due to the scope change.
The vulnerability was catalogued by Patchstack, whose advisory entry describes the affected plugin versions and confirms the SQL injection vector. The associated EPSS score of 0.3585 reflects substantial exploitation likelihood without evidence of a rising trajectory from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52876
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.