CVE-2024-3552: 
WordPress vulnerability analysis and mitigation

The Web Directory Free WordPress plugin versions before 1.7.0 contains an unauthenticated SQL injection vulnerability identified as CVE-2024-3552. The vulnerability was discovered on May 23, 2024, and affects the plugin's AJAX functionality where a parameter is not properly sanitized and escaped before being used in SQL statements (WPScan).

The vulnerability stems from improper sanitization and escaping of a parameter in an AJAX action that is accessible to unauthenticated users. The flaw allows for various SQL injection techniques, including UNION, Time-Based, and Error-Based attacks. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating its severe nature (NVD).

The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries against the WordPress database, potentially leading to unauthorized access to sensitive information, modification of database contents, and compromise of the WordPress installation (WPScan).

The vulnerability is exploitable through the WordPress AJAX endpoint using the 'w2dc_get_map_marker_info' action. A proof of concept exploit has been publicly disclosed, demonstrating the ability to execute SQL injection attacks without authentication (WPScan).

The vulnerability has been patched in version 1.7.0 of the Web Directory Free plugin. Users are strongly advised to update to this version or later to protect their installations (WPScan).