CVE-2024-11437 is an SQL Injection vulnerability in the Timeline Designer WordPress plugin by solwininfotech. The issue exists in all versions up to 1.4 due to improper neutralization of special elements in the 's' parameter, which is used directly in SQL queries without sufficient escaping or parameterization. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, low attack complexity, and requires high privileges, but no user interaction.

Successful exploitation could allow an unauthenticated attacker to extract sensitive information from the database by injecting SQL commands via the vulnerable 's' parameter. The integrity and availability of the database are not impacted according to the CVSS vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Timeline Designer plugin or restricting access to it to trusted users only. Avoid exposing the vulnerable parameter to untrusted inputs. Monitor vendor channels for updates or patches addressing this vulnerability.