CVE-2024-12157

Summary

CVE-2024-12157 is a critical SQL Injection vulnerability affecting the Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin for WordPress. Versions up to 3.2.6 of this plugin are impacted by the issue. The vulnerability arises due to insufficient escaping on the 'id' parameter of the 'upc_delete_db_record' AJAX action. Attackers can exploit this weakness by appending additional SQL queries into existing ones, potentially extracting sensitive information from the database without authentication. Users running these outdated plugin versions are urged to update immediately to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.