CVE-2024-38755: 
WordPress vulnerability analysis and mitigation

An SQL Injection vulnerability (CVE-2024-38755) was discovered in the Designinvento DirectoryPress WordPress plugin, affecting versions up to 3.6.10. The vulnerability was initially reported by security researcher Peng Zhou on February 17, 2024, and was publicly disclosed on July 11, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (CWE-89). It received a CVSS v3.1 base score of 8.8 (HIGH) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack assigned a CVSS score of 8.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. The vulnerability requires Contributor-level privileges to exploit (NVD).

This SQL Injection vulnerability could allow a malicious actor with Contributor-level access to directly interact with the database, potentially leading to unauthorized data access and information theft. The high CVSS scores indicate significant potential impact on the confidentiality, integrity, and availability of the affected systems (Patchstack).

The vulnerability requires low attack complexity and Contributor-level privileges to exploit. While the attack vector is network-accessible, no user interaction is required for exploitation. Patchstack has classified this as a low priority issue that is unlikely to be exploited (Patchstack).

The vulnerability has been fixed in DirectoryPress version 3.6.11. Users are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).