This vulnerability (CVE-2024-25924) in Trustindex.io WP Testimonials plugin arises from improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It affects versions up to 1.4.3 of the plugin. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring high privileges, no user interaction, with a scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability could allow an attacker with sufficient privileges to manipulate SQL queries, potentially leading to unauthorized data disclosure. No patch or official remediation level has been published by the vendor as of the provided data.

The vulnerability can lead to unauthorized disclosure of sensitive data due to SQL Injection. The CVSS vector indicates that an attacker with high privileges on the system could exploit this remotely without user interaction. The impact includes high confidentiality loss and a minor availability impact. There is no indication of integrity compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the affected plugin and monitor for unusual database activity. Avoid exposing the plugin to untrusted networks or users with elevated privileges. Follow vendor channels for updates on patches or mitigations.