The vulnerability CVE-2024-43978 involves improper neutralization of special elements in SQL commands within the highwarden Super Store Finder plugin for WordPress, versions before 6.9.8. This SQL Injection flaw enables remote attackers to inject malicious SQL queries without authentication, resulting in high confidentiality impact and limited availability impact. The CVSS v3.1 base score is 9.3, reflecting the critical severity and ease of exploitation over the network with no privileges or user interaction required. No patch or vendor advisory details are currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to access or disclose sensitive database information, potentially compromising confidentiality. The integrity impact is not indicated, and availability impact is low. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin functionality or applying temporary mitigations if any are recommended by the vendor. Monitor official channels for updates.