CVE-2024-4144

MEDIUM

Simple Basic Contact Form <20240502 - RCE

Title source: llm
STIX 2.1

Description

The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0066
EPSS Percentile 47.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-94
Status published
Products (1)
wpkube/Simple Basic Contact Form < 20240502
Published May 14, 2024
Tracked Since Feb 18, 2026