This vulnerability (CVE-2024-38692) in Spiffy Plugins Spiffy Calendar is classified as CWE-89, indicating improper neutralization of special elements in SQL commands, commonly known as SQL Injection. It affects versions through 4.9.11. The CVSS 3.1 base score is 7.6, reflecting a network attack vector with low attack complexity but requiring high privileges and no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact and low availability impact, but no integrity impact. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

An attacker with high privileges could exploit this SQL Injection vulnerability to access or disclose sensitive information (high confidentiality impact) and cause limited denial of service (low availability impact). The integrity of the data is not impacted according to the CVSS vector. Since the attack requires high privileges, exploitation is limited to users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Spiffy Calendar versions to trusted users only and monitor for unusual activity. Avoid exposing the affected plugin to untrusted networks or users with high privileges. Follow vendor communications for updates on patches or mitigations.