CVE-2024-13435: 
WordPress vulnerability analysis and mitigation

The Ebook Downloader plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-13435) discovered in all versions up to and including 1.0. The vulnerability was disclosed on February 11, 2025, and affects the 'download' parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation (NVD, Wordfence).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 7.5 (High). The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires no user interaction (UI:N), has unchanged scope (S:U), and can result in high confidentiality impact (C:H) with no impact on integrity (I:N) or availability (A:N) (NVD).

This vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the database (NVD).

The vulnerability can be exploited by unauthenticated attackers through the manipulation of the 'download' parameter, requiring no special privileges or user interaction (NVD).

Users should upgrade to a version newer than 1.0 when available. No specific workarounds have been documented (NVD).