This vulnerability (CVE-2024-38793) in PriceListo Best Restaurant Menu by PriceListo is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It affects versions up to 1.4.1 and allows an attacker with network access and low privileges to inject SQL commands without user interaction. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, and partial privileges required. The impact includes high confidentiality loss and low availability impact. No official remediation or patch is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. This could compromise database contents but does not necessarily allow full system compromise. No known exploits are reported in the wild at this time.

There is no official patch or vendor-provided remediation available at this time. Users should monitor the vendor's advisories for updates. Until a fix is released, consider limiting network exposure of the affected plugin and applying any available workarounds or input validation controls if feasible. Avoid exposing the vulnerable component to untrusted networks.