CVE-2024-12030: 
WordPress vulnerability analysis and mitigation

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-12030) discovered in January 2025. The vulnerability affects all versions up to and including 1.3.3.5, where the 'key' attribute of the 'mdf_value' shortcode is susceptible to SQL injection attacks (NVD CVE).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries in the 'key' attribute of the 'mdf_value' shortcode. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD CVE).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to append additional SQL queries to existing ones, potentially enabling the extraction of sensitive information from the database (NVD CVE).

The vulnerability requires authentication with at least Contributor-level access to exploit. The attack complexity is considered low, requiring network access but no user interaction for successful exploitation (NVD CVE).

A patch has been released to address this vulnerability. Users are advised to update their MDTF plugin to versions newer than 1.3.3.5 (WordPress Patch).