CVE-2024-13725: 
WordPress vulnerability analysis and mitigation

The Keap Official Opt-in Forms plugin for WordPress contains a Local File Inclusion vulnerability, identified as CVE-2024-13725. This critical security flaw affects all versions up to and including 2.0.1. The vulnerability was discovered and disclosed in February 2025, leading to the temporary closure of the plugin in the WordPress repository as of February 20, 2025, pending a full security review (NVD, WordPress Plugin).

The vulnerability has received a CVSS score of 9.8, indicating its critical severity level. The security flaw allows for Local File Inclusion attacks, which could potentially enable unauthorized access to sensitive files on the affected WordPress installations (Wordfence).

The vulnerability's critical nature suggests significant potential impact on affected WordPress installations. As a Local File Inclusion vulnerability, it could allow attackers to access sensitive files and potentially compromise the security of websites running the vulnerable plugin versions (NVD).

In response to the discovery of this vulnerability, the plugin has been temporarily removed from the WordPress plugin repository as of February 20, 2025. Website administrators using the affected versions should consider disabling the plugin until a security patch is released (WordPress Plugin).