CVE-2024-7385 is a critical SQL Injection vulnerability in the WP Simple HTML Sitemap plugin for WordPress, affecting all versions up to and including 3.1. The issue arises from insufficient escaping and lack of proper preparation of the 'id' parameter in SQL queries. Authenticated attackers with Administrator privileges can append additional SQL commands to extract or manipulate sensitive database data. The vulnerability has a CVSS 3.1 base score of 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation allows an authenticated administrator to perform SQL Injection attacks, potentially leading to full compromise of the WordPress site's database. This includes unauthorized access to sensitive information, data modification, or deletion, severely impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the WP Simple HTML Sitemap plugin if possible. Monitor official vendor channels for updates regarding a security patch or official mitigation instructions.