What is the CVSS score of CVE-2024-55972?

CVE-2024-55972 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 8.3%.

Which versions of eTemplates are affected by CVE-2024-55972?

The chriscarvache eTemplates WordPress plugin (versions through 0.2.1) contains a critical SQL injection vulnerability allowing unauthenticated remote attackers to directly access and extract…

How to fix or mitigate CVE-2024-55972?

WITHIN 24 HOURS: Identify all WordPress installations using chriscarvache eTemplates plugin versions 0.2.1 and earlier; immediately disable or remove the plugin as interim containment. WITHIN 7 DAYS: Audit database access logs (past 90 days minimum) for evidence of suspicious SQL queries or unauthorized data access attempts; contact the plugin vendor directly to request patch timeline and confirm security advisory status. WITHIN 30 DAYS: Deploy Web Application Firewall (WAF) rules targeting WordPress SQL injection attack patterns; implement comprehensive database access monitoring and alerting; establish daily log review procedures until vendor patch deployment; verify database integrity and user permissions are properly restricted.

eTemplates CVE-2024-55972

CRITICAL

SQL Injection (CWE-89)

2024-12-16 audit@patchstack.com

SQLi

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.3 (CRITICAL)

CVE Published

Dec 16, 2024 - 15:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.

AnalysisAI

SQL injection in the chriscarvache eTemplates WordPress plugin (versions through 0.2.1) allows remote unauthenticated attackers to inject arbitrary SQL commands against the backing database. With CVSS 9.3 and a scope-changed impact (confidentiality high, availability low), successful exploitation can expose sensitive data stored beyond the plugin's own boundary. EPSS sits at 8.33% (92nd percentile), indicating meaningfully elevated exploitation probability, though no public exploit is identified at time of analysis.

Technical ContextAI

eTemplates is a WordPress plugin authored by chriscarvache that integrates with WordPress's MySQL/MariaDB backend. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into SQL statements without parameterization or proper escaping via WordPress's $wpdb->prepare() API. Because WordPress plugins share the site's database with the core CMS, scope-changed SQLi typically pivots from plugin-owned tables into the wp_users, wp_options, or wp_usermeta tables, where credential hashes and session-relevant data live.

Affected ProductsAI

The chriscarvache eTemplates WordPress plugin is affected in all versions up to and including 0.2.1, per the Patchstack-sourced advisory. No CPE string was provided in the input data, and the upstream description specifies 'from n/a through <= 0.2.1' meaning the lower-bound introducing version is not documented. Any WordPress site running eTemplates 0.2.1 or earlier should be considered vulnerable until proven otherwise.

RemediationAI

No vendor-released patch identified at time of analysis; the advisory bounds the vulnerable range at <= 0.2.1 with no fixed version cited in the provided data. The most reliable mitigation is to deactivate and remove the eTemplates plugin from affected WordPress installations until chriscarvache publishes a patched release, since the plugin appears to be low-traffic and a fix timeline is unknown. As compensating controls, deploy a WAF with WordPress-aware SQLi rulesets (Patchstack, Wordfence, or ModSecurity OWASP CRS) tuned to block tautology and UNION-based payloads against plugin endpoints - accepting that aggressive rules may break legitimate template editor traffic - and restrict access to the plugin's URLs via IP allowlisting on the web server if the plugin is only used by site administrators.