CVE-2024-0566 is a high severity SQL Injection flaw in Smart Manager WordPress Plugin, scored CVSS 7.2. The record says Smart Manager versions before 8.28.0 are affected. Update the plugin to 8.28.0 or later. The sections below cover how to check and what to do first.
What's affected
The record says Smart Manager versions before 8.28.0 are affected. It is exploitable by high privilege users such as an administrator.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with a base score of 7.2 (High). KEV status: not listed in the record.
Fixed version: Update the plugin to 8.28.0 or later.
How to check if you're exposed
From the WordPress server, list the installed version with WP-CLI.
wp plugin list --name=smart-manager --fields=name,status,version
You can also open Plugins in the admin dashboard. Any version at or below the one named in the record needs an update. You can also run a free in-browser dependency scan on project manifests to catch libraries that carry this CVE.
What to do now
- Back up the site, then update the plugin to the fixed release.
- Review administrator and subscriber accounts and remove ones you do not recognise.
- Check database and web logs for unusual requests to the plugin endpoints.
- Rescan your dependencies and plugins after the update to confirm the finding closes.
Why it matters
CWE-89 describes this class. SQL injection happens when input is placed into a database query without being separated from the query text. The database then treats part of the input as instructions, which can expose, change or delete data the page was never meant to reach. The standard cure is parameterized queries plus least privilege for the database account the application uses.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-02-12.
For a wider view, a free in-browser dependency scan and the Gold directory show where Smart Manager WordPress Plugin sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0566 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Do I need to remove the plugin?
Not if a fixed release is available. Update, and remove the plugin if you no longer use it.
Sources
- Safeguard Gold entry for CVE-2024-0566
- NVD record data for CVE-2024-0566, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
