CVE-2024-10009: 
WordPress vulnerability analysis and mitigation

The Melapress File Monitor WordPress plugin before version 2.1.0 contains a SQL injection vulnerability identified as CVE-2024-10009. The vulnerability exists in the plugin's functionality where a parameter is not properly sanitized and escaped before being used in SQL statements (WPScan, NVD).

The vulnerability is present in the 'Mark as read' functionality within the File Monitoring -> Recent Events section. When processing the 'target' parameter in admin-ajax.php, the plugin fails to properly sanitize and escape the input before using it in SQL queries. The vulnerability has been assigned a CVSS v3.1 score of 4.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N (WPScan, Wiz).

The vulnerability allows authenticated administrators to perform SQL injection attacks against the WordPress database. While the impact is limited by the requirement of administrative privileges, successful exploitation could lead to unauthorized database access, modification, or potential data exfiltration (Wiz).

Users should upgrade to Melapress File Monitor version 2.1.0 or later, which contains the fix for this vulnerability (Wiz).