CVE-2024-38773
Published: 22 July 2024
Summary
CVE-2024-38773 is a critical-severity SQL Injection (CWE-89) vulnerability in Formlift Formlift For Infusionsoft Web Forms. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-38773 is an unauthenticated blind SQL injection vulnerability (CWE-89) in the FormLift for Infusionsoft Web Forms plugin for WordPress, affecting all versions through 7.5.17. The flaw stems from improper neutralization of special elements in SQL commands and carries a CVSS 3.1 score of 9.3, reflecting network-accessible exploitation with low attack complexity and no required credentials or user interaction.
An attacker can send crafted requests directly to the plugin to perform blind SQL injection, potentially extracting sensitive data from the database or causing limited availability impact while maintaining confidentiality and scope elevation.
The referenced Patchstack advisories document the vulnerability but do not detail specific patches or mitigation steps beyond identifying the affected plugin version range. The EPSS score has reached 0.4504 without a documented rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37613
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.