CVE-2024-30239 HIGH

CVE-2024-30239: WordPress Zoho Campaigns plugin <= 2.0.6 - SQL Injection vulnerability

Vendor Zoho Campaigns

Product Zoho Campaigns

Weakness CWE-89 · SQLi

Published March 28, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.6.

Explanation of Vulnerability in Simple Terms

02Summary

Zoho Campaigns versions up to 2.0.6 contain a SQL injection vulnerability in a component requiring low-level authentication. An attacker with a valid user account can inject malicious SQL commands to read sensitive data from the database, including other users' information. The vulnerability also allows limited disruption of service availability.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the database, including other users' information and account details.

Potential impact on your site

04Site Impact

Unauthorized access to customer data, email lists, and campaign information stored in Zoho Campaigns.

Conditions required to exploit

05Prerequisites

Attacker must have a valid Zoho Campaigns user account with low-level privileges.

Key dates

06Disclosure timeline

March 28, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-30239 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities