Keap Official Opt-in Forms <= 2.0.1 - 未认证的有限本地文件包含 (Unauthenticated Limited Local File Inclusion)
平台
wordpress
组件
infusionsoft-official-opt-in-forms
修复版本
2.0.2
CVE-2024-13725 is a critical Local File Inclusion (LFI) vulnerability affecting the Keap Official Opt-in Forms plugin for WordPress. This vulnerability allows unauthenticated attackers to include arbitrary PHP files on the server, potentially leading to code execution and significant compromise. The vulnerability impacts versions of the plugin up to and including 2.0.1. A patch is expected to be released by the vendor.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
影响与攻击场景翻译中…
The impact of CVE-2024-13725 is severe due to the potential for arbitrary code execution. An attacker can leverage the LFI vulnerability to include malicious PHP files, effectively gaining control over the web server. This could lead to data breaches, defacement of the website, or even complete server takeover. The description highlights a particularly concerning scenario: if registerargcargv is enabled and pearcmd.php is present, the vulnerability could be exploited for Remote Code Execution (RCE), significantly expanding the attack surface. The ability to upload and include PHP files is a key prerequisite for exploitation, but the potential consequences are substantial.
利用背景翻译中…
CVE-2024-13725 was publicly disclosed on 2025-02-18. Public proof-of-concept (PoC) code is likely to emerge given the ease of exploitation associated with LFI vulnerabilities. The CRITICAL CVSS score indicates a high probability of exploitation. Active campaigns targeting WordPress plugins are common, so this vulnerability is likely to attract attention from malicious actors.
哪些人处于风险中翻译中…
WordPress websites using the Keap Official Opt-in Forms plugin, particularly those running versions 2.0.1 or earlier, are at significant risk. Shared hosting environments are especially vulnerable, as they often have limited access controls and are more susceptible to cross-site contamination. Websites with weak file upload security configurations are also at increased risk.
检测步骤翻译中…
• wordpress / composer / npm:
grep -r 'service=../../../../' /var/www/html/wp-content/plugins/keap-official-opt-in-forms/• generic web:
curl -I http://your-wordpress-site.com/wp-content/plugins/keap-official-opt-in-forms/service?service=../../../../etc/passwd | grep 'Content-Type:'攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.43% (63% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 高 — 完全崩溃或资源耗尽，完全拒绝服务。
受影响的软件
软件包信息
- 活跃安装数
- 1K小众
- 插件评分
- 1.9
- 需要WordPress版本
- 6.0+
- 兼容至
- 6.7.5
- 需要PHP版本
- 8.0+
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2024-13725 is to upgrade the Keap Official Opt-in Forms plugin to a version containing the fix. Until a patch is available, consider disabling the plugin entirely to prevent exploitation. If disabling the plugin is not feasible, implement strict file access controls on the WordPress server to prevent attackers from uploading malicious PHP files. Web Application Firewalls (WAFs) configured to detect and block attempts to include arbitrary files can provide an additional layer of defense. Monitor WordPress access logs for suspicious file inclusion attempts, particularly those targeting the service parameter.
修复方法
将 Keap Official Opt-in Forms 插件更新到最新可用版本。该漏洞存在于更早的版本中。这将解决本地文件包含问题。
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2024-13725 — LFI in Keap Official Opt-in Forms?
CVE-2024-13725 is a critical Local File Inclusion vulnerability in the Keap Official Opt-in Forms WordPress plugin, allowing attackers to include arbitrary PHP files and potentially execute code.
Am I affected by CVE-2024-13725 in Keap Official Opt-in Forms?
You are affected if you are using Keap Official Opt-in Forms plugin versions 2.0.1 or earlier. Upgrade immediately to mitigate the risk.
How do I fix CVE-2024-13725 in Keap Official Opt-in Forms?
Upgrade the Keap Official Opt-in Forms plugin to the latest version containing the fix. If upgrading is not immediately possible, disable the plugin or implement file access controls.
Is CVE-2024-13725 being actively exploited?
While active exploitation is not yet confirmed, the vulnerability's severity and ease of exploitation suggest a high likelihood of exploitation in the near future.
Where can I find the official Keap advisory for CVE-2024-13725?
Refer to the Keap website and WordPress plugin repository for official advisories and updates regarding CVE-2024-13725.