CVE-2024-13725

Summary

CVE-2024-13725 is a locally exploitable vulnerability affecting the Keap Official Opt-in Forms plugin for WordPress. Versions up to and including 2.0.1 are vulnerable to Local File Inclusion through the service parameter. This issue grants unauthenticated attackers the ability to include PHP files on the server, potentially leading to the execution of any PHP code contained therein. Sensitive data exposure, bypassing access controls, and code execution are possible consequences. If the server has register_argc_argv enabled and pearcmd.php is installed, this vulnerability could result in Remote Code Execution.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.