CVE-2024-30478: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability was discovered in the WordPress Announcement & Notification Banner Plugin (Bulletin) affecting versions through 3.8.5. The vulnerability was reported on October 25, 2023, and publicly disclosed on March 28, 2024, receiving the identifier CVE-2024-30478 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) with a CVSS v3.1 base score of 7.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The issue requires administrator privileges to exploit and has been assigned CWE-89 (NVD).

This SQL injection vulnerability could allow a malicious actor with administrator privileges to directly interact with the database, potentially leading to unauthorized data access, modification, or theft of sensitive information (Patchstack).

The vulnerability requires administrator-level privileges to exploit, which significantly reduces its potential impact. The issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

Users are advised to update to version 3.9.0 or later of the WordPress Announcement & Notification Banner Plugin to remediate this vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins as an additional security measure (Patchstack).