CVE-2024-2342: 
WordPress vulnerability analysis and mitigation

The Simply Schedule Appointments Booking Plugin for WordPress contains an SQL Injection vulnerability (CVE-2024-2342) that affects all versions up to and including 1.6.7.7. The vulnerability exists due to insufficient escaping of the customer_id parameter and inadequate preparation of SQL queries (NVD).

The vulnerability stems from improper handling of the customer_id parameter in SQL queries. The issue is classified as SQL Injection (CWE-89) and has received a CVSS v3.1 Base Score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This indicates a serious security issue with high potential impact across confidentiality, integrity, and availability (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor access or higher to append additional SQL queries to existing ones. This capability can be used to extract sensitive information from the database, potentially compromising the security of the WordPress installation (NVD).

The vulnerability requires an authenticated user with contributor-level access or higher to exploit. The attack complexity is considered low, requiring no user interaction beyond the attacker's actions, making it relatively straightforward to exploit for those with the necessary access level (NVD).

Users should update to a version newer than 1.6.7.7 of the Simply Schedule Appointments plugin to address this vulnerability. A patch has been made available through the WordPress plugin repository (WordPress Plugin).