The vulnerability CVE-2024-9887 affects the 'Login using WordPress Users (WP as SAML IDP)' plugin for WordPress, versions up to and including 1.15.6. It is a time-based SQL Injection (CWE-89) caused by improper neutralization of special elements in the 'id' parameter of SQL queries. Authenticated attackers with Administrator-level access can append malicious SQL queries to extract sensitive data from the backend database. The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated administrator or higher to perform time-based SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, modification of data, and disruption of service availability within the affected WordPress plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator-level access to trusted users only and monitor for suspicious activity related to the 'id' parameter in the plugin. Avoid using affected versions of the plugin if possible.