CVE-2024-1206 is an SQL Injection vulnerability in the WP Recipe Maker plugin for WordPress, affecting all versions up to and including 9.1.2. The issue is due to improper neutralization of special elements in the 'recipes' parameter, allowing authenticated attackers with subscriber-level privileges or higher to append additional SQL queries to existing ones. This can lead to unauthorized disclosure of sensitive database information. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated user with subscriber-level access or higher to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, modification of data, and disruption of availability within the affected WordPress site database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to the WP Recipe Maker plugin. Avoid exposing the vulnerable parameter to untrusted inputs.