This vulnerability (CVE-2024-38755) is an SQL Injection issue classified under CWE-89 in the DirectoryPress product by Designinvento. It affects versions through 3.6.10 and allows an attacker with low privileges to inject malicious SQL commands due to improper sanitization of input. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published yet.

Successful exploitation could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). Integrity of data is not impacted. The vulnerability requires network access and low privileges but no user interaction. There are no known active exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected DirectoryPress plugin to untrusted users or networks where possible.