CVE-2024-13680

Summary

CVE-2024-13680 is a vulnerability affecting the Form Builder CP plugin for WordPress. In versions up to 1.2.41, the plugin is susceptible to SQL Injection attacks. The issue arises due to insufficient escaping on user-supplied data in the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode. This defect enables attackers, with Contributor-level access and above, to inject additional SQL queries into existing queries, potentially exposing sensitive information from the database.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.