This vulnerability (CVE-2024-43969) in Spiffy Plugins Spiffy Calendar arises from improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It affects all versions through 4.9.12. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An attacker with high privileges could exploit this SQL Injection vulnerability to access or manipulate sensitive database information, potentially leading to data confidentiality breaches. The vulnerability does not impact data integrity but may cause limited availability issues. Since the scope is changed, the vulnerability could affect components beyond the initially vulnerable module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the affected Spiffy Calendar plugin and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted networks or users with elevated privileges.