The vulnerability CVE-2024-49609 in Brandon White's Author Discussion plugin (versions up to 0.2.2) is caused by improper neutralization of special elements used in SQL commands, resulting in a blind SQL injection flaw. This allows an attacker with low privileges and no user interaction to potentially extract sensitive information from the database, impacting confidentiality. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or official fix information is currently available.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data from the backend database, compromising confidentiality. The integrity is not impacted, and availability impact is low. The vulnerability requires low privileges and no user interaction, making it relatively accessible to attackers with some access to the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin and monitor for unusual database queries. Avoid exposing the vulnerable component to untrusted users. No official patch or workaround has been published at this time.