CVE-2024-13909 is a time-based SQL Injection vulnerability in the Accredible Certificates & Open Badges WordPress plugin (versions up to 1.4.9). The issue arises from improper neutralization of special elements in the 'orderby' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with Administrator privileges can exploit this to append malicious SQL commands, potentially extracting sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 4.9 (medium severity).

Successful exploitation allows an authenticated administrator to perform time-based SQL Injection attacks, enabling unauthorized reading of sensitive database information. The vulnerability does not impact availability or integrity directly but compromises confidentiality of data stored in the database. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual database query activity related to the 'orderby' parameter. Avoid using the vulnerable plugin version in production environments if possible.