Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery

The SSRF vulnerability allows an authenticated administrator to craft malicious webhooks that send requests to internal resources or external systems. This could lead to sensitive data exposure, unauthorized access to internal APIs, or even potential modification of internal configurations. An attacker could, for example, attempt to access internal databases or services that are not directly exposed to the internet. In a Multisite environment, the vulnerability could potentially impact multiple sites within the same installation. While the CVSS score is LOW, the potential for internal reconnaissance and lateral movement within a WordPress environment makes this a significant concern.

WordPress websites utilizing the Contact Form by Bit Form plugin, particularly those with administrator accounts and internal services accessible via HTTP or HTTPS. Shared hosting environments where multiple WordPress sites share the same server infrastructure are also at increased risk, as a compromised administrator account on one site could potentially be used to exploit the vulnerability on other sites.

• wordpress / composer / npm:

grep -r 'Webhook_url' /var/www/html/wp-content/plugins/contact-form-by-bit-form/*

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/contact-form-by-bit-form/webhook.php | grep -i 'server:'

1. 2025-01-25Disclosure

   disclosure

1. Reserviert2025-01-16
2. Veröffentlicht2025-01-25
3. Geändert2025-01-27
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade the Contact Form by Bit Form plugin to version 2.18.0 or later, which contains the fix. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider temporarily restricting access to the Webhooks integration feature. Implement strict input validation on any data used in webhook URLs to prevent attackers from injecting malicious URLs. Monitor WordPress logs for unusual outbound requests originating from the plugin, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger a webhook request to an internal service and verifying that the request is blocked or handled appropriately.

Plugin-Bewertung