CVE-2024-7780
CVSS V2 None
CVSS V3 None
Description
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the id parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Overview
- CVE ID
- CVE-2024-7780
- Assigner
- Wordfence
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-08-20T03:21:10.510Z
- Last Modified Date
- 2024-08-20T03:21:10.510Z
Weakness Enumerations
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-7780 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7780 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-08-20 13:03:43 | Added to TrackCVE |