The vulnerability CVE-2024-39638 is an improper neutralization of special elements used in an SQL command (SQL Injection) affecting the Roundup WP Registrations for the Events Calendar plugin up to version 2.12.2. It allows an attacker with low privileges to inject SQL commands without requiring user interaction, potentially compromising data confidentiality and causing limited availability issues. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation level has been provided as of the publication date.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the affected system, leading to high confidentiality impact such as unauthorized data disclosure. Integrity impact is not indicated, and availability impact is low. The vulnerability requires low privileges but no user interaction, increasing the risk of exploitation. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin functionality and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users or networks where possible.