CVE-2024-7651: 
WordPress vulnerability analysis and mitigation

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-7651) affecting versions up to and including 4.2.6. The vulnerability was discovered in August 2024 and is related to insufficient escaping of the 'app-builder-search' parameter (NVD).

The vulnerability stems from insufficient escaping on the user-supplied 'app-builder-search' parameter and lack of sufficient preparation on the existing SQL query. The severity of this vulnerability has been assessed with different CVSS v3.1 scores: NIST rates it as HIGH with a base score of 7.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while Wordfence rates it as MEDIUM with a score of 5.6 (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD).

The vulnerability allows unauthenticated attackers to append additional SQL queries into already existing queries, potentially leading to the extraction of sensitive information from the database (NVD).

The vulnerability can be exploited by unauthenticated attackers through the manipulation of the 'app-builder-search' parameter (NVD).

A patch has been released to address this vulnerability. Users should upgrade to version 4.3.4 or later of the App Builder plugin (Wordpress Patch).