CVE-2024-13496 is a time-based SQL Injection vulnerability in the GamiPress – Gamification plugin for WordPress, affecting all versions up to and including 7.3.1. The vulnerability arises from improper neutralization of special elements in the 'orderby' parameter, allowing unauthenticated attackers to append malicious SQL code to existing queries. This is due to insufficient escaping of user input and lack of adequate query preparation. The vulnerability can be exploited to extract sensitive information from the database. The issue was initially misreported as fixed in version 7.2.2, but the actual fix was implemented in version 7.3.2.

An unauthenticated attacker can exploit this vulnerability to perform time-based SQL Injection attacks, enabling them to extract sensitive information from the WordPress database used by the GamiPress plugin. The vulnerability does not allow modification or deletion of data (integrity impact is none), nor does it affect availability, but it compromises confidentiality. The high CVSS score (7.5) reflects the ease of exploitation and the potential impact on data confidentiality.

Users of the GamiPress plugin should upgrade to version 7.3.2 or later, where this vulnerability is fixed. Since the vulnerability was previously misreported as fixed in 7.2.2, ensure the plugin version is at least 7.3.2 before considering the issue resolved. No other mitigations are specified. Patch status is confirmed fixed in version 7.3.2.