CVE-2024-12270 is an SQL Injection vulnerability in the Beautiful taxonomy filters plugin for WordPress, affecting all versions up to and including 2.4.3. The issue arises from improper neutralization of special elements in the 'selects[0][term]' parameter, allowing unauthenticated attackers to append malicious SQL queries. This is due to insufficient escaping of user input and lack of prepared statements in the plugin's SQL query construction. The vulnerability enables extraction of sensitive database information without requiring authentication.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the WordPress database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable parameters via web application firewalls or other filtering mechanisms to mitigate risk.