CVE-2024-13184 is a time-based SQL Injection vulnerability in the Login Attempts module of The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, affecting all versions up to 3.0.12. The issue stems from improper neutralization of special elements in SQL commands (CWE-89), specifically due to insufficient escaping of user input and lack of prepared statements. This allows unauthenticated attackers to append malicious SQL queries to existing ones, potentially extracting sensitive data from the backend database. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with low attack complexity, no privileges or user interaction required, and high confidentiality impact without affecting integrity or availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database without requiring authentication. The vulnerability does not impact data integrity or availability but poses a significant confidentiality risk. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the Login Attempts module to reduce exposure.