This vulnerability (CVE-2024-32709) in WP-Recall arises from improper neutralization of special elements used in SQL commands, categorized under CWE-89 (SQL Injection). It affects WP-Recall versions up to 16.26.5 and allows remote attackers to execute SQL injection attacks without authentication or user interaction. The CVSS 3.1 base score is 9.3, reflecting critical severity with potential for high confidentiality impact and low availability impact. No patch or official fix has been published yet, and no known exploits have been observed in the wild.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system's database. This may lead to unauthorized data disclosure (confidentiality impact is high) and limited disruption of service (availability impact is low). Integrity impact is not indicated. The vulnerability is exploitable over the network with low complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds if available or restrict access to the vulnerable plugin functionality. Monitor vendor channels for updates and apply patches promptly once available.