CVE-2024-13594 is a SQL Injection vulnerability classified under CWE-89 affecting the Simple Downloads List plugin for WordPress, specifically versions up to and including 1.4.2. The vulnerability is due to improper neutralization of special elements in SQL commands, specifically insufficient escaping and lack of prepared statements for the 'category' attribute in the 'neofix_sdl' shortcode. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw by injecting additional SQL queries appended to existing ones. This allows unauthorized extraction of sensitive information from the underlying database, such as user data or configuration details. The vulnerability does not require user interaction and can be exploited remotely over the network. The CVSS 3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no impact on integrity or availability. No patches have been linked yet, and no known exploits are reported in the wild. The vulnerability highlights the importance of proper input validation, use of parameterized queries, and least privilege principles in WordPress plugin development.

The primary impact of this vulnerability is unauthorized disclosure of sensitive data stored in the WordPress database, which could include user credentials, personal information, or site configuration details. Although the integrity and availability of the system are not directly affected, the confidentiality breach can lead to further attacks such as privilege escalation, phishing, or targeted exploitation of exposed data. Organizations running affected versions of the Simple Downloads List plugin are at risk, especially if they allow Contributor-level users who may be malicious or compromised. The vulnerability could undermine trust in the affected websites and lead to regulatory or compliance issues if sensitive user data is exposed. Since WordPress powers a significant portion of websites worldwide, the scope of impact is broad, particularly for sites that rely on this plugin for download management.

To mitigate this vulnerability, organizations should immediately update the Simple Downloads List plugin to a patched version once available. In the absence of an official patch, administrators should restrict Contributor-level access and above to trusted users only, minimizing the risk of exploitation. Applying Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the 'category' attribute can provide temporary protection. Developers maintaining the plugin should implement parameterized queries or prepared statements for all database interactions involving user input. Additionally, input validation and sanitization should be enforced on the 'category' shortcode attribute to prevent injection of malicious SQL. Regular security audits and monitoring for unusual database queries can help detect exploitation attempts early. Backup and incident response plans should be reviewed to prepare for potential data breaches.