The vulnerability identified as CVE-2024-55990 affects the tsjippy Mollie for Contact Form 7 plugin, allowing improper neutralization of special elements in SQL commands. This results in a Blind SQL Injection vulnerability, which can be exploited remotely over the network by an attacker with high privileges and no user interaction required. The vulnerability impacts confidentiality with a high severity score of 7.6 (CVSS 3.1), indicating potential unauthorized data disclosure. The affected versions include all versions up to 5.0.0. There is no vendor advisory or patch link provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with high privileges to perform Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and minor disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only, and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted networks or users with high privileges. Do not rely on generic mitigations unless specifically recommended by the vendor.