CVE-2024-13320 is an SQL Injection vulnerability in the CURCY - WooCommerce Multi Currency - Currency Switcher WordPress plugin affecting all versions up to 2.3.6. The issue arises from improper neutralization of special elements in the 'wc_filter_price_meta[where]' parameter, allowing unauthenticated attackers to append malicious SQL queries. This is due to insufficient escaping of user input and inadequate preparation of the existing SQL query, potentially enabling extraction of sensitive database information. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been documented in the provided data.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database without requiring authentication. The vulnerability does not impact integrity or availability according to the CVSS vector but poses a confidentiality risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to vulnerable parameters if possible. Monitor vendor channels for updates and apply patches promptly once released.