SQL Injection Vulnerability in FULL – Cliente WordPress Plugin by FULL

CVE-2024-12023

What is CVE-2024-12023?

The FULL – Cliente plugin for WordPress is vulnerable to an SQL Injection attack via the 'formId' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. Authenticated attackers, with Subscriber-level access and higher, can exploit this weakness when the PRO version of the plugin is active, alongside the Elementor Pro and Elementor CRM plugins. The exploitation allows attackers to inject malicious SQL commands, potentially exposing sensitive information stored in the database.

References