CVE-2024-7651 is a SQL Injection vulnerability in the App Builder – Create Native Android & iOS Apps On The Flight WordPress plugin (versions up to 4.2.6). The issue arises from improper neutralization of special elements in the 'app-builder-search' parameter, allowing unauthenticated attackers to append malicious SQL queries. This is due to insufficient escaping of user input and lack of proper query preparation, enabling potential unauthorized data extraction from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 5.6, indicating medium severity. No known exploits are reported in the wild, and no patch or official fix has been disclosed yet.

An attacker can exploit this vulnerability to inject SQL commands via the 'app-builder-search' parameter without authentication. This can lead to unauthorized disclosure of sensitive information from the database, as well as potential integrity and availability impacts. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to mitigate risk. Monitor for updates from the vendor or trusted security sources to apply patches once released.