CVE-2024-6338 is a SQL Injection vulnerability in the FV Flowplayer Video Player WordPress plugin affecting all versions up to 7.5.46.7212. The issue arises from improper neutralization of special elements in the 'exclude' parameter, which is insufficiently escaped and improperly handled in SQL queries. Authenticated attackers with at least Subscriber privileges can exploit this to append malicious SQL commands, potentially extracting sensitive data from the backend database. The vulnerability is categorized under CWE-89 and has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to perform time-based SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information stored in the database, as well as potential modification or disruption of database operations. The high CVSS score reflects significant risk to data confidentiality, integrity, and availability within affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and consider disabling or removing the FV Flowplayer Video Player plugin if possible. Monitor for vendor updates and apply patches promptly once available.