CVE-2024-12416 is an SQL Injection vulnerability in the Live Sales Notification for Woocommerce – Woomotiv WordPress plugin. The issue arises from improper neutralization of special elements in an SQL command, specifically via the 'woomotiv_seen_products_.*' cookie parameter. The plugin fails to sufficiently escape user-supplied input and does not use prepared statements for the affected SQL query, enabling unauthenticated attackers to append malicious SQL code. This can result in unauthorized disclosure of sensitive database information. The vulnerability affects all versions up to and including 3.6.1.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the database by injecting arbitrary SQL commands. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to affected endpoints as a temporary measure. Monitor vendor channels for updates and apply patches promptly once available.