CVE-2024-12270 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🐛 **Flaw**: Insufficient escaping on user-supplied parameters + lack of prepared statements in the existing SQL query logic.

Q: Who is affected? (Versions/Components)

📦 **Vendor**: jonathandejong. 📉 **Affected**: WordPress Plugin 'Beautiful taxonomy filters' versions **≤ 2.4.3**. 🌐 **Platform**: WordPress sites running this specific plugin.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. ⚙️ **Config**: No authentication (PR:N) or user interaction (UI:N) required. 🌍 **Access**: Network accessible (AV:N). Easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: YES. 📂 **PoC**: Available on GitHub (RandomRobbieBF/CVE-2024-12270). 🌐 **Status**: Wild exploitation risk is high due to public PoC and low barrier to entry.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Official patch released. 📝 **Ref**: WordPress Trac changeset 3205710. ✅ **Action**: Update plugin to version > 2.4.3 immediately.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: HIGH. 🚨 **Priority**: Critical. Unauthenticated SQLi with public PoC means immediate compromise risk. Patch NOW or disable plugin.

Updated May 08, 2026 CVSS 7.5 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in 'Beautiful taxonomy filters' plugin. 💥 **Consequences**: Attackers can extract sensitive database info by manipulating the `selects[0][term]` parameter.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🐛 **Flaw**: Insufficient escaping on user-supplied parameters + lack of prepared statements in the existing SQL query logic.

Q3Who is affected? (Versions/Components)

📦 **Vendor**: jonathandejong. 📉 **Affected**: WordPress Plugin 'Beautiful taxonomy filters' versions **≤ 2.4.3**. 🌐 **Platform**: WordPress sites running this specific plugin.

Q4What can hackers do? (Privileges/Data)

🕵️ **Privileges**: Unauthenticated access required (No login needed!). 📂 **Data**: High impact (C:H). Attackers can read/extract sensitive data from the WordPress database.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. ⚙️ **Config**: No authentication (PR:N) or user interaction (UI:N) required. 🌍 **Access**: Network accessible (AV:N). Easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: YES. 📂 **PoC**: Available on GitHub (RandomRobbieBF/CVE-2024-12270). 🌐 **Status**: Wild exploitation risk is high due to public PoC and low barrier to entry.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for 'Beautiful taxonomy filters' plugin version. 📡 **Indicator**: Look for SQLi payloads in `selects[0][term]` parameter in HTTP requests.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Official patch released. 📝 **Ref**: WordPress Trac changeset 3205710. ✅ **Action**: Update plugin to version > 2.4.3 immediately.

Q9What if no patch? (Workaround)

🚫 **No Patch?**: Disable the plugin if not essential. 🛡️ **WAF**: Deploy Web Application Firewall rules to block SQLi patterns in `selects[0][term]`.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: HIGH. 🚨 **Priority**: Critical. Unauthenticated SQLi with public PoC means immediate compromise risk. Patch NOW or disable plugin.

Continue exploring

Vulnerability detail Full AI analysis (login) jonathandejong CWE-89