Local File Inclusion in Keap Official Opt-in Forms Plugin for WordPress

CVE-2024-13725

What is CVE-2024-13725?

The Keap Official Opt-in Forms plugin for WordPress is susceptible to Local File Inclusion vulnerabilities across all versions up to and including 2.0.1. By exploiting the 'service' parameter, unauthenticated attackers can include arbitrary PHP files from the server. This risk potentially leads to execution of malicious code, revealing sensitive information, and even bypassing access controls. In environments where 'register_argc_argv' is enabled and 'pearcmd.php' exists, an attack may escalate to Remote Code Execution, further compromising the server's security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References