CVE-2024-7854 identifies a critical SQL Injection vulnerability in the sjhoo Woo Inquiry plugin for WordPress, present in all versions up to and including 0.1. The root cause is insufficient escaping and lack of prepared statements for the user-supplied 'dbid' parameter within SQL queries. This improper neutralization of special elements (CWE-89) allows unauthenticated attackers to append arbitrary SQL commands to existing queries. Exploitation can lead to unauthorized data disclosure, data manipulation, or complete compromise of the backend database. The vulnerability is remotely exploitable over the network without requiring authentication or user interaction, making it highly accessible to attackers. The CVSS v3.1 base score is 10.0, reflecting critical impact on confidentiality, integrity, and availability, with low attack complexity and no privileges needed. Currently, no patches or official fixes have been released, and no known exploits are reported in the wild. However, the severity and ease of exploitation make this a significant threat for WordPress sites using this plugin, especially those handling sensitive or business-critical data.

The impact of CVE-2024-7854 is severe for organizations using the sjhoo Woo Inquiry plugin. Successful exploitation can lead to full database compromise, including theft of sensitive information such as user credentials, personal data, or business records. Attackers can also modify or delete data, potentially disrupting business operations or defacing websites. The vulnerability can be exploited remotely without authentication, increasing the attack surface and risk of automated mass exploitation campaigns. Organizations relying on this plugin for customer inquiries or data collection face risks of data breaches, regulatory non-compliance, reputational damage, and financial losses. Additionally, the compromise of WordPress sites can serve as a foothold for further network intrusion or malware deployment. Given WordPress's widespread use globally, the potential scale of impact is substantial.

Immediate mitigation steps include disabling the Woo Inquiry plugin until a secure patch is released. If disabling is not feasible, organizations should implement strict input validation and sanitization on the 'dbid' parameter, ensuring only expected numeric or safe values are accepted. Employing Web Application Firewalls (WAFs) with custom rules to detect and block SQL injection patterns targeting this parameter can reduce risk. Site administrators should monitor logs for suspicious query strings or error messages indicative of injection attempts. Regular backups of databases and website files should be maintained to enable recovery from potential data loss. It is critical to keep WordPress core, plugins, and themes updated and subscribe to vendor security advisories for timely patch deployment. Finally, consider conducting a security audit or penetration test to identify any exploitation attempts or residual vulnerabilities.