Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Keap Opt-in Forms plugin for WordPress allows unauthorized file access

CVE-2024-13725 · published 1 year ago
Summary

An attacker can access any file on the server, potentially stealing sensitive information or taking control of the site, by exploiting a weakness in the plugin's coding. This affects all versions of the Keap Opt-in Forms plugin for WordPress up to 2.0.1. Update the plugin to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
keap keap_official_opt_in_forms <= 2.0.1
cpe:2.3:a:keap:keap_official_opt_in_forms:*:*:*:*:*:wordpress:*:*
Original advisory text
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthent...
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published18 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-13725 · NVD
Track software like this
Free during beta