{"id":"CVE-2024-32134","state":"PUBLISHED","title":"WordPress Forms to Zapier plugin <= 1.1.12 - Auth. SQL Injection vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook.This issue affects Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook: from n/a through 1.1.12.","publishedAt":"2024-04-15T07:32:47.635Z","updatedAt":"2026-04-28T16:09:34.856Z","severity":{"score":7.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","source":"Patchstack"},"assigner":"Patchstack","products":["Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook"],"affected":[{"vendor":"Nasirahmed","product":"Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook","packageName":"forms-to-zapier","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.1.12","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/vulnerability/forms-to-zapier/wordpress-forms-to-zapier-plugin-1-1-12-sql-injection-vulnerability?_s_id=cve"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/32xxx/CVE-2024-32134.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-32134","state":"PUBLISHED","datePublished":"2024-04-15T07:32:47.635Z","dateUpdated":"2026-04-28T16:09:34.856Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2024-04-11T13:13:38.238Z"},"containers":{"cna":{"title":"WordPress Forms to Zapier plugin <= 1.1.12 - Auth. SQL Injection vulnerability","descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook.This issue affects Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook: from n/a through 1.1.12."}],"affected":[{"vendor":"Nasirahmed","product":"Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook","packageName":"forms-to-zapier","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.1.12","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/vulnerability/forms-to-zapier/wordpress-forms-to-zapier-plugin-1-1-12-sql-injection-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:09:34.856Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Muhammad Daffa (Patchstack Alliance)"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-32134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-15T16:37:51.472890Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:50:49.381Z"}},{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/database/vulnerability/forms-to-zapier/wordpress-forms-to-zapier-plugin-1-1-12-sql-injection-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T02:06:43.983Z"}}]}}}