CVE-2024-3200: wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3200?
CVE-2024-3200 is considered a high severity vulnerability due to the potential for SQL injection attacks.
How do I fix CVE-2024-3200?
To fix CVE-2024-3200, update the wpForo Forum plugin to version 2.3.4 or later.
What versions are affected by CVE-2024-3200?
CVE-2024-3200 affects all versions of the wpForo Forum plugin up to and including version 2.3.3.
What impact does CVE-2024-3200 have on my website?
CVE-2024-3200 can allow an attacker to execute arbitrary SQL queries, potentially compromising your WordPress site's database.
Is SQL Injection a common vulnerability in WordPress plugins like CVE-2024-3200?
Yes, SQL Injection vulnerabilities like CVE-2024-3200 are common in poorly secured WordPress plugins that do not validate user inputs.