CVE-2021-24391: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24391 affects the Cashtomer WordPress plugin version 1.0.0 and below. The issue was discovered by Syed Sheeraz Ali of Codevigilant and was publicly disclosed on July 23, 2021. The vulnerability is an authenticated SQL injection that exists in the plugin's handling of the 'editid' GET parameter (CodeVigilant, WPScan).

The vulnerability exists in the '/admin/view/socialadd.php' file where the 'editid' GET parameter is not properly sanitized, escaped, or validated before being inserted into a SQL statement. The vulnerability has been assigned a CVSS score of 6.7 (medium) and is classified as CWE-89: SQL Injection. The issue falls under the OWASP Top 10 category A1: Injection (WPScan, CodeVigilant).

When exploited, this vulnerability could allow an authenticated attacker to execute arbitrary SQL queries against the WordPress database, potentially leading to unauthorized access to sensitive information or manipulation of database contents (WPScan).

As of the latest reports, there is no known fix available for this vulnerability. The plugin has been closed since April 19, 2021. Users are advised to consider removing the plugin or implementing additional security measures to restrict access to the vulnerable functionality (WPScan).