CVE-2024-47312: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2024-47312) was discovered in WPGrim Classic Editor and Classic Widgets plugin affecting versions through 1.4.1. The vulnerability was reported by researcher Hakiduck on August 30, 2024, and was publicly disclosed on September 25, 2024. The issue affects WordPress installations using the Classic Editor and Classic Widgets plugin (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) with a CVSS v3.1 base score of 8.5 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is changed (S:C) with high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L) (Patchstack).

This vulnerability is considered highly dangerous and expected to become mass exploited. It could allow a malicious actor to directly interact with the database, potentially leading to unauthorized access to sensitive information. The vulnerability can be exploited by users with subscriber-level privileges (Patchstack).

Users are advised to update to version 1.4.2 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to a fixed version (Patchstack).