CVE-2024-7780: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the id parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7780?
CVE-2024-7780 has been classified as a critical severity level due to its potential for exploiting SQL injection vulnerabilities.
How do I fix CVE-2024-7780?
To fix CVE-2024-7780, update the Bitapps Contact Form Builder plugin to version 2.13.10 or later.
Which versions of the Contact Form Builder are affected by CVE-2024-7780?
CVE-2024-7780 affects versions 2.0 to 2.13.9 of the Contact Form by Bit Form plugin.
What type of vulnerability is CVE-2024-7780?
CVE-2024-7780 is a generic SQL Injection vulnerability targeting the id parameter.
Who is impacted by CVE-2024-7780?
Users of the Bitapps Contact Form Builder plugin for WordPress running affected versions are at risk due to CVE-2024-7780.