The vulnerability CVE-2024-47328 affects the Aman FunnelKit Automations plugin for WordPress, specifically versions up to 3.1.2. It is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The CVSS 3.1 score is 7.6 (High), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss, no integrity loss, and low availability loss. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, leading to disclosure of sensitive data (confidentiality impact is high). Integrity is not affected, and availability impact is low. The vulnerability requires network access and high privileges, limiting the attack surface to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for unusual activity related to FunnelKit Automations. Avoid exposing administrative interfaces to untrusted networks.