PT-2025-2178 · WordPress · The Contact Form By Bit Form

Francesco Carlucci · Published 2025-01-25 · Updated 2025-02-04 · CVE-2024-13450

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Contact Form by Bit Form plugin for WordPress versions up to and including 2.17.4

Description The issue is related to Server-Side Request Forgery, which can be exploited via the Webhooks integration. This allows authenticated attackers with Administrator-level access and above to make web requests to arbitrary locations, potentially querying and modifying internal services. The issue can also be exploited in Multisite environments.

Recommendations For versions up to and including 2.17.4, consider disabling the Webhooks integration as a temporary workaround until a patch is available. Restrict access to the Webhooks functionality to minimize the risk of exploitation. Avoid using the Webhooks integration in Multisite environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-13450

Affected Products

The Contact Form By Bit Form

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-13450 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13450 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L51 · Note
• https://twitter.com/CVEnew/status/1883074909590413718 · Twitter Post
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L96 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d935f4c5-5d69-42d9-be22-7a44d9aa885a?source=cve · Note
• https://t.me/cvenotify/110000 · Telegram Post
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L190 · Note
• https://t.me/cvedetector/16384 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3227207 · Note
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/AdminFormHandler.php#L1072 · Note
• https://t.me/cvenotify/108604 · Telegram Post
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/AdminFormHandler.php#L1312 · Note
• https://twitter.com/VulmonFeeds/status/1883124741025722413 · Twitter Post