The enituretechnology Distance Based Shipping Calculator plugin versions up to 2.0.23 suffer from an SQL Injection vulnerability (CVE-2024-52495) caused by improper neutralization of special elements in SQL commands. This allows an attacker with network access and low privileges to execute crafted SQL commands, potentially exposing sensitive data and causing partial denial of service. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects confidentiality and availability but not integrity.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database and partial denial of service conditions. The vulnerability does not allow modification of data (integrity impact is none). There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for unusual database activity. Avoid exposing the plugin to untrusted networks. Follow vendor channels for updates on official fixes.