CVE-2024-11460 is an SQL Injection vulnerability in the Verowa Connect WordPress plugin (versions up to 3.0.1). The issue arises from improper neutralization of special elements in the 'search_string' parameter, allowing attackers to append malicious SQL code to existing queries. This occurs because user input is not sufficiently escaped and the SQL queries lack proper preparation, enabling unauthorized data extraction from the backend database. The vulnerability is remotely exploitable without authentication and does not require user interaction.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database. The attacker can manipulate SQL queries to extract data, potentially compromising confidentiality. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Verowa Connect plugin if possible. Avoid exposing the vulnerable parameter to untrusted input. Monitor vendor channels for updates and apply patches promptly once released.