CVE-2024-37225 HIGH

CVE-2024-37225: WordPress Zoho Marketing Automation plugin <= 1.2.7 - SQL Injection vulnerability

Vendor Zoho Marketing Automation
Product Zoho Marketing Automation
Weakness CWE-89 · SQLi
Published July 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketing Automation: from n/a through 1.2.7.

Explanation of Vulnerability in Simple Terms

02Summary

Zoho Marketing Automation versions up to 1.2.7 contain a SQL injection vulnerability in a network-accessible endpoint that requires low-level authentication. An attacker with valid credentials can inject malicious SQL queries to read sensitive data from the database. The vulnerability also impacts system availability. A patch version has not been publicly identified.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the database and degrade system availability by injecting SQL commands.

Potential impact on your site

04Site Impact

Unauthorized access to database records and potential service disruption if the application relies on this component.

Conditions required to exploit

05Prerequisites

Attacker must have valid user credentials (low-level account) and network access to the application.

Key dates

06Disclosure timeline

July 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57739 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability CVE-2026-61949 WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability CVE-2026-25405 WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability CVE-2026-12941 MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1