PT-2024-29401 · WordPress · Simple Basic Contact Form

Matthew Rollings + 1 · Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-4144

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Simple Basic Contact Form plugin for WordPress versions up to and including 20240502

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes, depending on the functionality of other plugins installed in the environment. The severity and exploitability of this issue vary based on the specific plugins and their configurations.

Recommendations For versions up to and including 20240502, update to a version that contains a fix for this issue, as using arbitrary shortcode execution can pose significant risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-4144

Affected Products

Simple Basic Contact Form

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-4144 · Security Note
• https://plugins.trac.wordpress.org/changeset/3085036 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve · Note
• https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543 · Note