CVE-2024-5792

HIGH 8.8 CVSS 3.1

Published: July 10, 2024
Last modified: June 17, 2026
NVD status: Deferred
Reported by: security@wordfence.com
Weakness: CWE-89
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belong_to’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected products and versions

Houzez Houzez CRM — Up to and including 1.4.2
houzez houzez_crm — Up to and including 1.4.2

References

favethemes.zendesk.com https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d4df4b-ec7a-43f6-8617-161b1600d6d2?source=cve
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References