PatchTheCVECVE-2024-12030: The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' a
CVE-2024-12030 is a medium-severity flaw (CVSS 6.5) affecting wordpress meta data and taxonomies filter. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into al
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 56%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2025-01-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-12030?
wordpress meta data and taxonomies filter: upgrade to 1.3.3.6. Exact commands for each OS are on this page.
Is CVE-2024-12030 being exploited?
CVE-2024-12030 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-12030 affect?
CVE-2024-12030 affects wordpress meta data and taxonomies filter. Severity is medium (CVSS 6.5). The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user suppl
How urgent is CVE-2024-12030?
Priority 34/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2024-8624 CRITICAL 9.9 UPGRADE The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_k
- CVE-2024-8623 HIGH 7.3 UPGRADE The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execu
- CVE-2024-50450 HIGH 7.3 UPGRADE Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter
- CVE-2024-34434 MEDIUM 6.5 UPGRADE Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Co
- CVE-2024-32818 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue