CVE-2024-24868: 
WordPress vulnerability analysis and mitigation

The SP Project & Document Manager WordPress plugin contains an SQL Injection vulnerability (CVE-2024-24868) that affects versions up to and including 4.69. The vulnerability was discovered by Yudistira Arya and publicly disclosed on February 2, 2024. The issue exists in the sp_cdm_display_project_shortcode_show function due to insufficient escaping of user-supplied parameters and inadequate SQL query preparation (WPScan, Patchstack).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (High) according to NVD, and 8.5 (High) according to Patchstack. The vulnerability allows authenticated users with contributor-level access or higher to append additional SQL queries to existing queries, potentially enabling the extraction of sensitive information from the database (WPScan).

Successful exploitation of this vulnerability could allow authenticated attackers with contributor-level privileges to interact directly with the database, potentially leading to unauthorized access to sensitive information stored in the WordPress database (Patchstack).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack vector is through the sp_cdm_display_project_shortcode_show function, where attackers can manipulate SQL queries due to insufficient input validation (WPScan).

The vulnerability has been patched in version 4.70 of the SP Project & Document Manager plugin. Users are advised to update to version 4.70 or later to remediate this security issue (Patchstack).