CVE-2024-12195 is an SQL Injection vulnerability identified in the WP Project Manager plugin for WordPress, which provides task, team, and project management features including kanban boards and Gantt charts. The vulnerability exists in all versions up to and including 2.6.16 and is triggered via the 'project_id' parameter in the REST API endpoint /wp-json/pm/v2/projects/2/task-lists. The root cause is improper neutralization of special elements in SQL commands (CWE-89), specifically due to insufficient escaping of user-supplied input and the absence of prepared statements or parameterized queries. This flaw allows an authenticated attacker, who has access to a project, to append arbitrary SQL queries to the existing query. Consequently, the attacker can extract sensitive information from the underlying database, compromising confidentiality. The CVSS v3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, required privileges (authenticated with project access), no user interaction, and high impact on confidentiality but no impact on integrity or availability. No public exploits have been reported yet, but the vulnerability poses a significant risk to organizations relying on this plugin for project management within WordPress environments.

The primary impact of this vulnerability is the unauthorized disclosure of sensitive data stored in the WordPress database, which may include project details, user information, and other confidential content managed via the WP Project Manager plugin. Since the attack requires authentication with project access, the threat is limited to insiders or compromised accounts with legitimate project permissions. However, once exploited, attackers can perform data exfiltration, potentially leading to information leakage, privacy violations, and compliance issues. The integrity and availability of the system are not directly affected, but the confidentiality breach can damage organizational trust and lead to further targeted attacks. Organizations using this plugin in environments with sensitive project data are at risk, especially if they have weak access controls or compromised user credentials.

Organizations should immediately update the WP Project Manager plugin to a version that addresses this vulnerability once released by the vendor. Until a patch is available, administrators should restrict project access strictly to trusted users and monitor access logs for suspicious activity. Implementing Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the 'project_id' parameter can provide temporary protection. Additionally, enforcing strong authentication and regularly auditing user permissions can reduce the risk of exploitation. Developers and site administrators should review custom code interacting with this plugin to ensure proper input validation and use of parameterized queries. Regular backups and monitoring for unusual database queries can help detect and recover from potential exploitation.