Server-Side Request Forgery Vulnerability in Contact Form Plugin by Bit Form for WordPress

CVE-2024-13450

Summary

The Contact Form by Bit Form plugin for WordPress is subject to a Server-Side Request Forgery vulnerability found in all versions up to and including 2.17.4. This security flaw permits authenticated attackers with Administrator-level access to initiate web requests to arbitrary URLs originating from the application itself. This can lead to unauthorized interactions with internal services, which may include querying, modifying sensitive information, or accessing internal resources. The issue is particularly concerning in Multisite setups where multiple sites share the same resources, amplifying the potential impact of the exploit.

References