This vulnerability (CVE-2024-38693) in the WP User Frontend plugin by weDevs is classified as CWE-89 (SQL Injection). It allows an attacker with high privileges to inject malicious SQL commands due to improper sanitization of input used in SQL queries. The affected versions include all releases up to 4.0.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or official fix has been published yet.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact is high) and partial disruption of service (availability impact is low). Integrity impact is not indicated. The vulnerability requires high privileges, limiting the attack surface to authenticated users with elevated rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual database activity. Avoid granting unnecessary high privileges to users. No official patch or temporary fix has been published by the vendor at this time.