CVE-2024-13435 is an SQL Injection vulnerability in the iwcontribution Ebook Downloader WordPress plugin affecting all versions up to 1.0. The issue arises from improper neutralization of special elements in the 'download' parameter, allowing unauthenticated attackers to append malicious SQL queries to existing database queries. This vulnerability can be exploited to extract sensitive information from the backend database. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No patch or official fix has been published as of the data provided.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to retrieve sensitive information from the database by injecting SQL commands through the vulnerable 'download' parameter. The integrity and availability of the system are not impacted according to the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Applying web application firewall (WAF) rules that detect and block SQL injection attempts targeting the 'download' parameter may provide temporary protection.