CVE-2024-43144 is an SQL Injection vulnerability (CWE-89) in StylemixThemes Cost Calculator Builder plugin versions up to 3.2.15. It allows remote attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability is exploitable without authentication (AV:N/AC:L/PR:N/UI:N) and can lead to a complete confidentiality breach (C:H) with limited impact on availability (A:L). The vulnerability is publicly disclosed but currently lacks an official fix or patch from the vendor. No known active exploitation has been reported.

An attacker can exploit this vulnerability remotely without authentication to execute arbitrary SQL commands on the backend database. This can lead to full disclosure of sensitive data (confidentiality impact is high). The integrity of data is not impacted according to the CVSS vector, and availability impact is low. The vulnerability poses a critical risk to affected installations until remediated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to mitigate risk. Monitor for updates from StylemixThemes and apply patches promptly once released.