Search criteria
2 vulnerabilities found for Keap Official Opt-in Forms by infusionsoft
CVE-2024-13725 (GCVE-0-2024-13725)
Vulnerability from nvd – Published: 2025-02-18 04:21 – Updated: 2025-02-18 15:02
VLAI?
Title
Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion
Summary
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
Severity ?
9.8 (Critical)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| infusionsoft | Keap Official Opt-in Forms |
Affected:
* , ≤ 2.0.1
(semver)
|
Credits
Hiroho Shimada
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T15:02:29.697078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T15:02:35.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Keap Official Opt-in Forms",
"vendor": "infusionsoft",
"versions": [
{
"lessThanOrEqual": "2.0.1",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hiroho Shimada"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T04:21:16.466Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/692a5838-4a32-4444-b1a0-018fa25594a9?source=cve"
},
{
"url": "https://wordpress.org/plugins/infusionsoft-official-opt-in-forms/"
},
{
"url": "https://plugins.trac.wordpress.org/browser/infusionsoft-official-opt-in-forms/trunk/infusionsoft.php#L2540"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-23T00:00:00.000+00:00",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-02-17T15:45:57.000+00:00",
"value": "Disclosed"
}
],
"title": "Keap Official Opt-in Forms \u003c= 2.0.1 - Unauthenticated Limited Local File Inclusion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13725",
"datePublished": "2025-02-18T04:21:16.466Z",
"dateReserved": "2025-01-24T19:13:27.192Z",
"dateUpdated": "2025-02-18T15:02:35.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13725 (GCVE-0-2024-13725)
Vulnerability from cvelistv5 – Published: 2025-02-18 04:21 – Updated: 2025-02-18 15:02
VLAI?
Title
Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion
Summary
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
Severity ?
9.8 (Critical)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| infusionsoft | Keap Official Opt-in Forms |
Affected:
* , ≤ 2.0.1
(semver)
|
Credits
Hiroho Shimada
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T15:02:29.697078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T15:02:35.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Keap Official Opt-in Forms",
"vendor": "infusionsoft",
"versions": [
{
"lessThanOrEqual": "2.0.1",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hiroho Shimada"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T04:21:16.466Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/692a5838-4a32-4444-b1a0-018fa25594a9?source=cve"
},
{
"url": "https://wordpress.org/plugins/infusionsoft-official-opt-in-forms/"
},
{
"url": "https://plugins.trac.wordpress.org/browser/infusionsoft-official-opt-in-forms/trunk/infusionsoft.php#L2540"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-23T00:00:00.000+00:00",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-02-17T15:45:57.000+00:00",
"value": "Disclosed"
}
],
"title": "Keap Official Opt-in Forms \u003c= 2.0.1 - Unauthenticated Limited Local File Inclusion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13725",
"datePublished": "2025-02-18T04:21:16.466Z",
"dateReserved": "2025-01-24T19:13:27.192Z",
"dateUpdated": "2025-02-18T15:02:35.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}