This vulnerability (CVE-2024-21747) is an SQL Injection flaw in the WP ERP plugin by weDevs, impacting versions through 1.12.8. It involves improper neutralization of special elements in SQL commands (CWE-89), which can be exploited by an attacker with high privileges to affect the confidentiality and availability of the system. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No official patch or remediation level has been disclosed by the vendor as of the publication date.

An attacker with high privileges can exploit this SQL Injection vulnerability to compromise the confidentiality of data and cause a partial denial of service. The vulnerability does not impact integrity but can lead to unauthorized data exposure and service disruption. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted users only and monitor for unusual activity related to the WP ERP plugin. Avoid exposing the affected plugin to untrusted networks or users with elevated privileges.