The vulnerability identified as CVE-2024-49246 affects the 'Ajax Rating with Custom Login' plugin (versions up to 1.1) by anand23. It is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. This allows remote attackers to execute arbitrary SQL code without authentication or user interaction, potentially leading to full disclosure of sensitive data and partial disruption of service. The CVSS 3.1 base score is 9.3, reflecting critical impact on confidentiality and some impact on availability. No patch or official remediation guidance has been provided yet, and the plugin is not a cloud service.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information due to SQL Injection. The attacker can remotely execute SQL commands without any privileges or user interaction, potentially compromising the confidentiality of the affected system's data. There is also a low impact on availability, possibly causing partial service disruption. Integrity impact is not indicated. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to prevent exploitation. Monitor official sources for updates and apply patches promptly once available.