This vulnerability (CVE-2024-30478) affects the Bulletin WordPress Announcement & Notification Banner Plugin (up to version 3.8.5). It is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. The CVSS v3.1 base score is 7.6, reflecting a high severity with network attack vector, low attack complexity, required privileges, no user interaction, and a scope change. The vulnerability allows an attacker with high privileges to potentially manipulate SQL queries, impacting confidentiality and availability. No patch or official remediation guidance is currently available, and no exploits have been observed in the wild.

Successful exploitation could allow an attacker with high privileges to manipulate SQL queries within the Bulletin plugin, potentially leading to unauthorized disclosure of sensitive information (confidentiality impact) and partial denial of service (availability impact). Integrity impact is not indicated. The vulnerability requires the attacker to have privileges on the system, limiting the attack surface somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to trusted administrators only and monitor for unusual activity related to the Bulletin plugin. Avoid exposing administrative interfaces to untrusted networks. No official patch or temporary fix is currently available.