CVE-2024-55982
Published: 16 December 2024
Summary
CVE-2024-55982 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 3.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a blind SQL injection flaw (CWE-89) stemming from improper neutralization of special elements in SQL commands within the Share Buttons – Social Media WordPress plugin developed by richteam. It affects all versions through 1.0.2 and carries a CVSS 3.1 score of 9.3, reflecting network-accessible exploitation with low attack complexity, no required privileges or user interaction, and changed scope.
Unauthenticated remote attackers can exploit the issue to inject malicious SQL payloads, achieving high-impact disclosure of sensitive data along with limited effects on availability. The changed scope means successful attacks may affect resources beyond the vulnerable component itself.
The Patchstack advisory for this CVE documents the affected plugin versions and associated risk, indicating that site operators should apply updates once a patched release becomes available to eliminate the injection vector. The EPSS score has remained flat at 0.3180 with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52882
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.