CVE-2024-30498: 
WordPress vulnerability analysis and mitigation

An SQL Injection vulnerability (CVE-2024-30498) was discovered in CRM Perks Forms WordPress plugin affecting versions up to and including 1.1.4. The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries, allowing unauthenticated attackers to manipulate database queries (Patchstack, WPScan).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 base score of 10.0 (Critical) according to NVD, and 9.3 according to Patchstack. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

The vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to unauthorized access to sensitive information stored in the database. The critical CVSS score indicates the potential for complete compromise of system confidentiality, integrity, and availability (Patchstack).

The vulnerability is exploitable by unauthenticated attackers and requires no user interaction or special privileges. The low attack complexity suggests that exploitation could be straightforward for attackers with basic SQL injection knowledge (WPScan).

The vulnerability has been fixed in version 1.1.5 of the CRM Perks Forms plugin. Users are strongly advised to update to this version immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).