This vulnerability (CVE-2024-34386) in the Auto Affiliate Links plugin by Lucian Apostol is categorized as CWE-89 (SQL Injection). It affects versions up to 6.4.3.1 and allows improper neutralization of special characters in SQL commands. The CVSS 3.1 base score is 7.6, indicating a high severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact includes potential confidentiality loss and limited availability impact, with no integrity impact. No patch or official remediation level has been provided yet.

An attacker with high privileges could exploit this vulnerability to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact) and limited disruption of service (availability impact). Integrity is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege access to the affected plugin and monitor for unusual database activity. Avoid exposing the plugin to untrusted users with high privileges. Follow vendor channels for updates on patches or official mitigations.