Vulnerability · Published May 14, 2024 · Assigned by Wordfence
CVE-2024-4144Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution
Medium 6.5
In plain English
A medium-severity code injection in Simple Basic Contact Form from wpkube. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpkube | Simple Basic Contact Form | 0 – through 20240502 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L