This vulnerability (CVE-2024-43286) in the Squirrly SEO Plugin by Squirrly SEO is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It affects all versions up to 12.3.19. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality (high) and availability (low). The vulnerability allows an attacker to inject malicious SQL commands due to insufficient sanitization of input used in SQL queries. No patch or official fix has been disclosed yet.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Squirrly and consider applying temporary mitigations such as restricting plugin usage to trusted users or disabling the plugin if feasible. Avoid exposing the affected plugin to untrusted users. No vendor advisory or patch links are currently available.