CVE-2024-12613 is a SQL Injection vulnerability affecting the coder426 Passwords Manager WordPress plugin up to version 1.4.8. The issue stems from insufficient escaping of the $wpdb->prefix user-supplied parameter in multiple AJAX functions, allowing unauthenticated attackers to inject additional SQL queries. This improper neutralization of special elements in SQL commands (CWE-89) can lead to unauthorized extraction of sensitive information from the database. The vulnerability is remotely exploitable without authentication and requires low attack complexity. No vendor patch or official fix has been documented yet.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks by appending malicious SQL to existing queries via the $wpdb->prefix parameter. This can lead to unauthorized disclosure of sensitive database information. The vulnerability does not impact integrity or availability directly but compromises confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable Passwords Manager plugin or restricting access to AJAX endpoints if possible. Monitor vendor channels for updates and apply patches promptly once released.