CVE-2025-24672: WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24672?
CVE-2025-24672 is classified as a critical severity SQL Injection vulnerability.
How do I fix CVE-2025-24672?
To remediate CVE-2025-24672, update the CodePeople Form Builder CP plugin to a version higher than 1.2.41.
What are the potential impacts of CVE-2025-24672?
Exploitation of CVE-2025-24672 can lead to unauthorized access to the database, data leakage, and manipulation of the data.
Which versions of Form Builder CP are affected by CVE-2025-24672?
CVE-2025-24672 affects all versions of the CodePeople Form Builder CP plugin prior to and including version 1.2.41.
Is CVE-2025-24672 exploitable remotely?
Yes, CVE-2025-24672 is exploitable remotely, allowing attackers to perform SQL injection from outside the application.