Local File Inclusion in Keap Official Opt-in Forms Plugin for WordPress

CVE-2024-13725

Summary

The Keap Official Opt-in Forms plugin for WordPress is susceptible to Local File Inclusion vulnerabilities across all versions up to and including 2.0.1. By exploiting the 'service' parameter, unauthenticated attackers can include arbitrary PHP files from the server. This risk potentially leads to execution of malicious code, revealing sensitive information, and even bypassing access controls. In environments where 'register_argc_argv' is enabled and 'pearcmd.php' exists, an attack may escalate to Remote Code Execution, further compromising the server's security.

References