WordPress WP Lead Capturing Pages Plugin SQL Injection Vulnerability

A blind SQL injection vulnerability has been identified in the WordPress WP Lead Capturing Pages plugin, specifically in versions through 2.5. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious actors to interact with the database in unauthorized ways.

Impact

Exploitation of this vulnerability could lead to unauthorized database access, allowing attackers to manipulate or extract sensitive information.

Remediation

Users are advised to update to a version of the WP Lead Capturing Pages plugin that is later than 2.5. For those using Patchstack, a mitigation rule has been issued to block attacks until an official fix can be applied.