CVE-2021-24451: 
WordPress vulnerability analysis and mitigation

CVE-2021-24451 is a SQL injection vulnerability discovered in the WordPress plugin 'Export Users With Meta' affecting versions below 0.6.5. The vulnerability was publicly disclosed on June 21, 2021, and was discovered by security researcher Asif Nawaz Minhas (WPScan).

The vulnerability exists because the plugin fails to properly escape the list of roles to export before using them in a SQL statement within the export functionality. This vulnerability is classified as a SQL Injection (SQLI) and falls under the OWASP Top 10 category A1: Injection with CWE-89. The vulnerability has been assigned a CVSS score of 6.8, indicating medium severity (WPScan).

The vulnerability affects the export functionality available to administrators. When successfully exploited, it could allow authenticated administrators to perform SQL injection attacks against the WordPress database, potentially leading to unauthorized data access or manipulation (WPScan).

The vulnerability requires authentication with administrator privileges to exploit. A proof of concept exists demonstrating the exploitation through a specially crafted POST request to '/wp-admin/users.php?page=uewm_settings' with malicious SQL injection payload in the 'uewm_roles[]' parameter (WPScan).

The vulnerability has been fixed in version 0.6.5 of the Export Users With Meta plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).