CVE-2024-3750: 
WordPress vulnerability analysis and mitigation

The Visualizer: Tables and Charts Manager for WordPress plugin is affected by a vulnerability (CVE-2024-3750) discovered in all versions up to and including 3.10.15. The vulnerability was disclosed on May 15, 2024, and involves unauthorized modification and retrieval of data due to a missing capability check in the getQueryData() function (NVD).

The vulnerability stems from a missing capability check in the getQueryData() function, which allows authenticated attackers with subscriber-level access or higher to perform arbitrary SQL queries. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability can lead to privilege escalation and unauthorized data manipulation. Attackers with subscriber-level access can perform arbitrary SQL queries, potentially accessing and modifying sensitive data within the WordPress installation (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. Once authenticated, an attacker can leverage the missing capability check to execute arbitrary SQL queries (NVD).

Users are advised to upgrade to version 3.11.0 or later, which includes fixes for this vulnerability. The fix implements proper capability checks in the affected function (NVD).