CVE-2024-3217 is an SQL Injection vulnerability in the WP Directory Kit WordPress plugin affecting all versions up to 1.3.0. The issue is due to improper neutralization of special elements in SQL commands, specifically insufficient escaping of user-supplied 'attribute_value' and 'attribute_id' parameters. This allows authenticated attackers with subscriber-level privileges or higher to inject additional SQL queries into existing database queries, potentially leading to unauthorized data disclosure. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database, as attackers can inject and execute arbitrary SQL commands. The impact affects confidentiality, integrity, and availability of the affected system. The vulnerability requires authenticated access at subscriber level or above, which limits the attack surface but still poses a significant risk due to the high severity score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the 'attribute_value' and 'attribute_id' parameters. Avoid using affected versions of the plugin in production environments if possible.