CVE-2024-55990: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2024-55990) was discovered in Ewald Harmsen's Mollie for Contact Form 7 WordPress plugin affecting versions through 5.0.0. The vulnerability was disclosed on December 14, 2024, and received a CVSS v3.1 base score of 7.6 (High) (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, specifically allowing Blind SQL Injection attacks. The issue requires high privileges to exploit but has a critical impact on confidentiality and low impact on availability. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L (NVD).

The vulnerability could allow an authenticated attacker with administrator privileges to directly interact with the database, potentially leading to unauthorized access to sensitive information and limited impact on system availability (Patchstack).

As of the disclosure date, no official fix has been released for this vulnerability. The issue affects versions up to and including 5.0.0 of the Mollie for Contact Form 7 plugin (Patchstack).