This vulnerability (CVE-2024-30243) in Tomas WordPress Tooltips arises from improper neutralization of special elements used in SQL commands, categorized under CWE-89 (SQL Injection). It affects versions prior to 9.4.5 of the plugin. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and resulting in high confidentiality impact and low availability impact. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with low privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity impact is not indicated. Since no known exploits are reported, the threat is theoretical but significant given the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's functionality and monitoring for unusual database activity. Avoid granting unnecessary privileges to users who can interact with the plugin. Do not assume the vulnerability is mitigated without vendor confirmation.