CVE-2024-12023: 
WordPress vulnerability analysis and mitigation

The FULL – Cliente plugin for WordPress contains an SQL Injection vulnerability (CVE-2024-12023) affecting versions 3.1.5 through 3.1.25. The vulnerability was discovered and reported by Wordfence, with the disclosure date being May 2, 2025 (NVD, Wiz).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 6.5 (MEDIUM). The security flaw exists in the plugin's handling of the 'formId' parameter, which lacks proper input validation and SQL query preparation. This vulnerability is only exploitable when specific conditions are met: the PRO version of the plugin must be activated, along with Elementor Pro and Elementor CRM (NVD, Wiz).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to append additional SQL queries to existing queries. This can be exploited to extract sensitive information from the database, potentially compromising the security and confidentiality of the WordPress installation (NVD).

The vulnerability requires authentication with at least Subscriber-level access and specific plugin configurations to be exploitable. The attacker must have access to a valid WordPress account and the target site must have both the PRO version of FULL – Cliente plugin and Elementor Pro with Elementor CRM activated (NVD).

The vulnerability has been patched in version 3.1.26 of the FULL – Cliente plugin. The fix includes improved input validation for the 'formId' parameter, as evidenced by the code changes in the repository (WordPress Plugin). Users are advised to update to version 3.1.26 or later to protect against this vulnerability.