CVE-2024-2954: WordPress Action Network plugin SQL Injection vulnerability. Authenticated administrators can inject SQL queries to extract sensitive data.

CVE-2024-2954 exposes WordPress sites using the Action Network plugin to a SQL Injection vulnerability. This flaw, present in version 1.4.3, allows authenticated attackers with administrator privileges to inject malicious SQL code via the 'bulk-action' parameter. Successful exploitation could enable attackers to extract sensitive information directly from the WordPress database. Despite a relatively low CVSS score of 4.9, the presence of this vulnerability In The Wild indicates active exploitation attempts. The SVRS score of 30 suggests a moderate risk. While not critical, immediate patching is still recommended to prevent potential data breaches and maintain the integrity of the WordPress site. This highlights the importance of promptly addressing even moderately scored vulnerabilities, especially with publicly available exploits.