CVE-2024-13750 is an SQL Injection vulnerability identified in the Multilevel Referral Affiliate Plugin for WooCommerce, a WordPress plugin developed by prismitsystems. The flaw exists in all versions up to and including 2.27, where the 'orderby' parameter is insufficiently escaped and improperly handled in SQL queries. This improper neutralization of special SQL elements (CWE-89) allows authenticated attackers with Subscriber-level privileges or higher to append arbitrary SQL commands to existing queries. The vulnerability does not require user interaction and can be exploited remotely over the network (AV:N). The attack complexity is low (AC:L), and the attacker only needs low privileges (PR:L). Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database, compromising confidentiality (C:H) but not affecting integrity or availability. Although no public exploits have been reported, the vulnerability poses a significant risk to WordPress sites using this plugin, especially those handling sensitive affiliate and e-commerce data. The lack of patches at the time of disclosure necessitates immediate mitigation efforts.

The primary impact of this vulnerability is the unauthorized disclosure of sensitive information stored in the WordPress database, which may include user data, affiliate referral details, and potentially payment-related information depending on the site configuration. Since the vulnerability allows SQL Injection via a parameter accessible to low-privileged authenticated users, attackers can escalate their access to sensitive data without needing administrative privileges. This can lead to data breaches, loss of customer trust, and regulatory compliance issues such as GDPR violations. Although the vulnerability does not affect data integrity or availability, the exposure of confidential data can have severe reputational and financial consequences for organizations. E-commerce sites relying on this plugin are particularly at risk, as attackers could leverage stolen data for fraud or further attacks.

Organizations should immediately upgrade the Multilevel Referral Affiliate Plugin for WooCommerce to a patched version once available. In the absence of an official patch, implement strict input validation and sanitization on the 'orderby' parameter to ensure only expected values are accepted. Employ Web Application Firewalls (WAFs) with custom rules to detect and block SQL Injection attempts targeting this parameter. Restrict user roles and permissions to minimize the number of users with Subscriber-level or higher access, and monitor logs for unusual query patterns or access attempts. Additionally, conduct regular security audits and database access reviews to detect potential exploitation. Consider isolating the WordPress database with least privilege access controls and encrypting sensitive data at rest to reduce impact if data is accessed. Finally, maintain up-to-date backups to enable recovery in case of compromise.