CVE-2024-52431 is an SQL Injection vulnerability (CWE-89) in the Pressaholic WordPress Video Robot - The Ultimate Video Importer plugin, affecting versions through 1.20.0. The vulnerability arises from improper neutralization of special elements used in SQL commands, allowing remote attackers to execute arbitrary SQL code without authentication. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction needed, with a scope change and high confidentiality impact. No official patch or remediation level has been disclosed by the vendor. The vulnerability is publicly known but no active exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system's database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). The integrity impact is reported as none. The vulnerability affects the confidentiality of data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or uninstalling the affected plugin to prevent exploitation. Monitor official Pressaholic communications and trusted vulnerability databases for updates. No vendor-provided temporary fixes or workarounds are currently documented.