CVE-2024-12030: 
WordPress vulnerability analysis and mitigation

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-12030) discovered in January 2025. The vulnerability affects all versions up to and including 1.3.3.5, where the 'key' attribute of the 'mdf_value' shortcode is susceptible to SQL injection attacks (NVD CVE).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries in the 'key' attribute of the 'mdf_value' shortcode. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD CVE).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to append additional SQL queries to existing ones, potentially enabling the extraction of sensitive information from the database (NVD CVE).

A patch has been released to address this vulnerability. Users are advised to update their MDTF plugin to versions newer than 1.3.3.5 (WordPress Patch).