This vulnerability (CVE-2024-43969) in Spiffy Plugins Spiffy Calendar arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects all versions up to 4.9.12. The CVSS 3.1 base score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, but no integrity impact. No vendor patch or official remediation has been published yet.

An attacker with high privileges can exploit this SQL Injection vulnerability to compromise the confidentiality of the database and cause a limited denial of service. The vulnerability does not affect integrity but may allow unauthorized data disclosure. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the affected Spiffy Calendar plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted networks where possible.