CVE-2024-11732 is a time-based SQL Injection vulnerability in the BP Profile Shortcodes Extra WordPress plugin affecting all versions up to 2.6.0. The issue arises from improper neutralization of special elements in the 'tab' parameter, allowing authenticated users with Contributor-level privileges or higher to append malicious SQL commands to existing queries. This vulnerability can be leveraged to extract sensitive data from the database. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and resulting in high confidentiality impact but no integrity or availability impact. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated user with Contributor-level access or above to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect data integrity or availability but compromises confidentiality. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access carefully and consider disabling or removing the BP Profile Shortcodes Extra plugin if possible to reduce risk.