CVE-2024-1893: 
WordPress vulnerability analysis and mitigation

The Easy Property Listings plugin for WordPress contains a time-based SQL Injection vulnerability (CVE-2024-1893) in versions up to and including 3.5.2. The vulnerability exists in the 'property_status' shortcode attribute due to insufficient escaping of user-supplied parameters and inadequate SQL query preparation (NVD).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (High). The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), needs low privileges (PR:L), requires no user interaction (UI:N), has unchanged scope (S:U), and can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) (Wordfence).

When exploited, this vulnerability allows authenticated attackers with contributor access or higher to append additional SQL queries to existing ones, potentially leading to the extraction of sensitive information from the database (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack can be executed through the manipulation of the 'property_status' shortcode attribute (NVD).

Users are advised to update to version 3.5.3 or later which contains the fix for this vulnerability (WordPress Plugin).