CVE-2024-13369 is a time-based SQL Injection vulnerability in the Tour Master - Tour Booking, Travel, Hotel WordPress plugin affecting all versions up to 5.3.7. The issue arises from improper neutralization of special elements in the 'review_id' parameter, allowing authenticated users with low privileges (Subscriber-level and above) to append malicious SQL queries. This vulnerability is due to insufficient escaping of user input and lack of prepared statements in the SQL query construction, enabling unauthorized extraction of sensitive data from the database.

An authenticated attacker with Subscriber-level access or higher can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the backend database. The vulnerability does not affect system availability or integrity but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to the 'review_id' parameter. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates for patches or official mitigations.