nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-13453 CVE-2024-13453
HIGH
Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution
Record summary
CVE-2024-13453 has a selected CVSS score of 7.3 (high).
Description
The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 30, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Contact Form & SMTP Plugin for WordPress by PirateFormsBrowse smub / Contact Form & SMTP Plugin for WordPress by PirateFormsDefault status: unaffected | CVE List | Through 2.6.0 | affected |
References
4plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/pirate-forms/tags/2.6.0/gutenberg/class-pirateforms-gutenberg.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3225666%40pirate-forms&old=3219203%40pirate-forms&sfp_email=&sfph_mail= wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/98859214-7acf-4d40-9291-b5669b9614b7?source=cve