Cyber Resilience

CVE-2024-30498

Critical

Published: 29 March 2024

Published
29 March 2024
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.1500 94.7th percentile
Risk Priority 28 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-30498 is a critical-severity SQL Injection (CWE-89) vulnerability in Crmperks Crm Perks Forms. Its CVSS base score is 9.3 (Critical).

Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-30498 is an unauthenticated SQL injection vulnerability (CWE-89) affecting the CRM Perks Forms WordPress plugin from n/a through version 1.1.4. The flaw stems from improper neutralization of special elements in SQL commands and carries a CVSS 3.1 score of 9.3, reflecting network attack vector, low complexity, no required privileges or user interaction, and changed scope with high confidentiality impact plus limited availability impact.

Remote attackers without authentication can exploit the issue over the network to extract sensitive data or disrupt service availability in affected installations. The vulnerability resides in the plugin's form-handling components that process unsanitized input directly into database queries.

Public advisories published by Patchstack identify the flaw as an unauthenticated SQL injection in the WordPress CRM Perks Forms plugin up to 1.1.4 and provide the associated vulnerability database entries for further reference.

EPSS for this CVE rose from lower values to a peak of 0.3846 on 2026-03-13 before receding to the current 0.1500, indicating a material increase in exploitation interest after disclosure.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

crmperks
crm perks forms
≤ 1.1.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References