CVE-2024-12023

The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the PRO version of the plugin is activated, along with Elementor Pro and Elementor CRM.

• CWE-89

• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.25/app/controller/elementor-crm/Hooks.php#L181
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.26/app/controller/elementor-crm/Hooks.php#L181
• https://www.wordfence.com/threat-intel/vulnerabilities/id/86e990ae-6bfe-4f2b-8c37-b0675430a638?source=cve

Published

May 2, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12018The Snippet Shortcodes plugin for WordPress is vulnerable to…4.3
• CVE-2024-12019The API used to interact with documents in the application c…7.1
• CVE-2024-1202Authentication Bypass by Primary Weakness vulnerability in X…9.8
• CVE-2024-12020There is a reflected cross-site scripting (XSS) within JSP f…6.1
• CVE-2024-12021Coverity versions prior to 2024.9.0 are vulnerable to stored…8.5
• CVE-2024-12022Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-12024The EventPrime – Events Calendar, Bookings and Tickets plugi…6.1
• CVE-2024-12025The Collapsing Categories plugin for WordPress is vulnerable…7.5
• CVE-2024-12026The Message Filter for Contact Form 7 plugin for WordPress i…4.3
• CVE-2024-12027The Message Filter for Contact Form 7 plugin for WordPress i…4.3
• CVE-2024-12028The Friends plugin for WordPress is vulnerable to unauthoriz…5.3
• CVE-2024-12029A remote code execution vulnerability exists in invoke-ai/in…9.8