This vulnerability (CVE-2024-43966) in Stark Digital's WP Testimonial Widget arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects all versions up to 3.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires high privileges, no user interaction, and results in high confidentiality impact and low availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with high privileges could exploit this SQL Injection vulnerability to compromise the confidentiality of the database, potentially accessing sensitive information. The impact on integrity is not indicated, and availability impact is low. There are no known exploits in the wild, so active exploitation has not been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict access to the affected plugin and monitor for updates from Stark Digital. No official fixes or temporary mitigations have been published at this time.