This vulnerability (CVE-2024-38788) in Bởi Admin 2020's UiPress lite plugin is an SQL Injection issue classified under CWE-89. It affects versions through 3.4.06 and allows an attacker with high privileges to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access privileges to trusted users only and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted users. No vendor-provided temporary fixes or workarounds are currently documented.