PT-2024-3155 · WordPress · Forminator

Published 2024-04-12 · Updated 2025-04-04 · CVE-2024-31077

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Forminator versions prior to 1.29.3

Description The issue is related to a SQL injection vulnerability due to a lack of protection measures for the SQL query structure. This vulnerability can be exploited by a remote attacker to modify arbitrary data and cause a denial-of-service condition. A remote authenticated attacker with administrative privileges may obtain and alter any information in the database.

Recommendations For versions prior to 1.29.3, upgrade the plugin to the latest version immediately. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation. Audit your site for any signs of compromise after applying the update.

Fix

DoS

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-03368

CVE-2024-31077

Affected Products

Forminator

References · 14

• https://osv.dev/vulnerability/CVE-2024-31077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31077 · Security Note
• https://bdu.fstec.ru/vul/2024-03368 · Security Note
• https://t.me/cvenotify/77722 · Telegram Post
• https://wordpress.org/plugins/forminator · Note
• https://wpmudev.com · Note
• https://t.me/true_secator/5665 · Telegram Post
• https://twitter.com/oktsec/status/1783987728582853110 · Twitter Post
• https://vuldb.com/ru/?id.261754 · Note
• https://securitylab.ru/news/547669.php · Note
• https://t.me/bizone_channel/1205 · Telegram Post
• https://jvn.jp/en/jp/JVN50132400 · Note
• https://xakep.ru/2024/04/23/forminator-critical-bug · Note
• https://t.me/cvenotify/117742 · Telegram Post