CVE-2024-13713 is an SQL Injection vulnerability in the WPExperts Square For GiveWP WordPress plugin affecting all versions up to 1.3.1. The issue arises from improper neutralization of special elements in the 'post' parameter, allowing authenticated users with at least Subscriber-level access to append malicious SQL queries to existing database queries. This can result in unauthorized disclosure of sensitive data stored in the database. The vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 6.5 (medium severity). No patch or remediation details have been provided by the vendor, and it is not a cloud service.

An attacker with authenticated access at Subscriber level or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect availability or integrity but compromises confidentiality. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to minimize risk and monitor for suspicious activity related to this plugin. Avoid granting unnecessary Subscriber-level access to untrusted users.