CVE-2024-13321 is an SQL Injection vulnerability in the AnalyticsWP plugin for WordPress affecting all versions up to and including 2.0.0. The issue arises from insufficient authorization checks on the handle_get_stats() function, specifically via the 'custom_sql' parameter. This flaw enables unauthenticated attackers to append malicious SQL commands to existing queries, which can lead to unauthorized data disclosure from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The impact is limited to confidentiality as per the CVSS vector, with no direct integrity or availability impact reported. This could lead to data leakage and compromise of sensitive data stored in the AnalyticsWP plugin's database tables.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the AnalyticsWP plugin if possible or restrict access to the affected functionality to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.