CVE-2024-47334 HIGH

CVE-2024-47334: WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability

Vendor Zoho Flow
Product Zoho Flow
Weakness CWE-89 · SQLi
Published October 9, 2024
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through <= 2.7.1.

Explanation of Vulnerability in Simple Terms

02Summary

Zoho Flow versions up to 2.7.1 contain a SQL injection vulnerability accessible to high-privilege users. An authenticated administrator can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive data from the database. The vulnerability affects the entire application scope and does not require user interaction.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the database by injecting SQL commands through the application.

Potential impact on your site

04Site Impact

Administrators with malicious intent or compromised admin accounts can extract confidential data from your Zoho Flow database.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege administrator access to Zoho Flow.

Key dates

06Disclosure timeline

October 9, 2024 CVE published
May 11, 2026 Record updated