CVE-2024-12609 is an SQL Injection vulnerability in the dasinfomedia School Management System for WordPress plugin affecting versions up to 92.0.0. The issue is due to improper neutralization of special elements in SQL commands within the mj_smgt_view_student_attendance() function on the 'view-attendance' page. Authenticated users with at least Student-level privileges can inject additional SQL queries by manipulating a user-supplied parameter, enabling unauthorized extraction of sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 score of 6.5 (medium severity). There is no vendor advisory or patch link provided, and no known exploits have been reported.

Successful exploitation allows authenticated users with Student-level access or higher to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity. Avoid granting unnecessary privileges to users. Follow vendor communications for updates on patches or official mitigations.