The vulnerability identified as CVE-2024-12030 affects the MDTF – Meta Data and Taxonomies Filter plugin for WordPress, specifically versions up to and including 1.3.3.5. The root cause is an SQL Injection flaw (CWE-89) stemming from insufficient escaping and lack of proper preparation of the SQL query that processes the 'key' attribute of the 'mdf_value' shortcode. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw by injecting additional SQL commands into existing queries. This injection capability allows attackers to extract sensitive information from the backend database, such as user data or site configuration details, without requiring administrative privileges or user interaction. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring only privileges of a Contributor or above (PR:L). The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component. The confidentiality impact is high (C:H), while integrity and availability impacts are none (I:N, A:N). No patches have been linked yet, and no known exploits have been observed in the wild. The vulnerability was published on January 8, 2025, and assigned a CVSS v3.1 score of 6.5, indicating medium severity. The plugin is used in WordPress environments, which are widely deployed globally, making this a relevant threat to many organizations using this plugin for metadata and taxonomy filtering.

The primary impact of this vulnerability is unauthorized disclosure of sensitive data stored in the WordPress database. Attackers with Contributor-level access can leverage this flaw to extract confidential information, potentially including user credentials, personal data, or site configuration details. While the vulnerability does not allow modification or deletion of data, the exposure of sensitive information can lead to further attacks such as privilege escalation, identity theft, or targeted phishing campaigns. Organizations relying on this plugin risk data breaches that could damage reputation, violate data protection regulations, and incur financial penalties. Since WordPress powers a significant portion of websites worldwide, especially small to medium enterprises and content-driven sites, the scope of impact is broad. The requirement for authenticated access limits exploitation to insiders or compromised accounts, but the low privilege level needed increases the risk. The absence of known exploits in the wild suggests limited active exploitation currently, but the vulnerability remains a significant risk until remediated.

1. Immediate mitigation involves restricting Contributor-level and higher user privileges to trusted individuals only, minimizing the risk of exploitation from compromised accounts. 2. Monitor and audit Contributor and above user activities for suspicious behavior indicative of SQL injection attempts. 3. Apply strict input validation and sanitization on the 'key' attribute in the shortcode if custom code or temporary patches are feasible. 4. Disable or remove the MDTF plugin if it is not essential to reduce the attack surface until an official patch is released. 5. Maintain regular backups of the WordPress database to enable recovery in case of data compromise. 6. Follow vendor announcements closely and apply official patches or updates as soon as they become available. 7. Employ Web Application Firewalls (WAFs) with custom rules to detect and block SQL injection patterns targeting the vulnerable shortcode parameter. 8. Use principle of least privilege for all WordPress roles and consider implementing multi-factor authentication to reduce risk of account compromise. These steps go beyond generic advice by focusing on role-based access control, monitoring, and temporary protective measures specific to this plugin’s vulnerability.