Vulnerability in Bit Form's Multi Step Form Plugin Could Allow SQL Injection

CVE-2024-7780

Summary

The Contact Form by Bit Form plugin for WordPress is susceptible to a SQL Injection flaw via the 'id' parameter in versions ranging from 2.0 to 2.13.9. This vulnerability arises from inadequate input escaping and a lack of robust SQL query preparation, allowing authenticated attackers with Administrator privileges or higher to inject additional SQL commands into existing queries. This attack vector potentially exposes sensitive data from the database, making it critical for site administrators to secure their installations and apply necessary updates.

References