What is the CVSS score of CVE-2024-55972?

CVE-2024-55972 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 8.3%.

Which versions of eTemplates are affected by CVE-2024-55972?

The chriscarvache eTemplates WordPress plugin (versions through 0.2.1) contains a critical SQL injection vulnerability allowing unauthenticated remote attackers to directly access and extract…

How to fix or mitigate CVE-2024-55972?

WITHIN 24 HOURS: Identify all WordPress installations using chriscarvache eTemplates plugin versions 0.2.1 and earlier; immediately disable or remove the plugin as interim containment. WITHIN 7 DAYS: Audit database access logs (past 90 days minimum) for evidence of suspicious SQL queries or unauthorized data access attempts; contact the plugin vendor directly to request patch timeline and confirm security advisory status. WITHIN 30 DAYS: Deploy Web Application Firewall (WAF) rules targeting WordPress SQL injection attack patterns; implement comprehensive database access monitoring and alerting; establish daily log review procedures until vendor patch deployment; verify database integrity and user permissions are properly restricted.

eTemplates CVE-2024-55972

CRITICAL

SQL Injection (CWE-89)

2024-12-16 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.3 (CRITICAL)

CVE Published

Dec 16, 2024 - 15:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.

AnalysisAI

SQL injection in the chriscarvache eTemplates WordPress plugin (versions through 0.2.1) allows remote unauthenticated attackers to inject arbitrary SQL commands against the backing database. With CVSS 9.3 and a scope-changed impact (confidentiality high, availability low), successful exploitation can expose sensitive data stored beyond the plugin's own boundary. EPSS sits at 8.33% (92nd percentile), indicating meaningfully elevated exploitation probability, though no public exploit is identified at time of analysis.

Technical ContextAI

eTemplates is a WordPress plugin authored by chriscarvache that integrates with WordPress's MySQL/MariaDB backend. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into SQL statements without parameterization or proper escaping via WordPress's $wpdb->prepare() API. Because WordPress plugins share the site's database with the core CMS, scope-changed SQLi typically pivots from plugin-owned tables into the wp_users, wp_options, or wp_usermeta tables, where credential hashes and session-relevant data live.

Affected ProductsAI

The chriscarvache eTemplates WordPress plugin is affected in all versions up to and including 0.2.1, per the Patchstack-sourced advisory. No CPE string was provided in the input data, and the upstream description specifies 'from n/a through <= 0.2.1' meaning the lower-bound introducing version is not documented. Any WordPress site running eTemplates 0.2.1 or earlier should be considered vulnerable until proven otherwise.

RemediationAI

No vendor-released patch identified at time of analysis; the advisory bounds the vulnerable range at <= 0.2.1 with no fixed version cited in the provided data. The most reliable mitigation is to deactivate and remove the eTemplates plugin from affected WordPress installations until chriscarvache publishes a patched release, since the plugin appears to be low-traffic and a fix timeline is unknown. As compensating controls, deploy a WAF with WordPress-aware SQLi rulesets (Patchstack, Wordfence, or ModSecurity OWASP CRS) tuned to block tautology and UNION-based payloads against plugin endpoints - accepting that aggressive rules may break legitimate template editor traffic - and restrict access to the plugin's URLs via IP allowlisting on the web server if the plugin is only used by site administrators.