CVE-2024-13450: SSRF in Contact Form by Bit Form

The SSRF vulnerability in Contact Form by Bit Form allows an authenticated administrator to craft malicious web requests originating from the WordPress application. This means an attacker could potentially query internal services that are not directly accessible from the outside world, such as internal APIs, databases, or even other internal web applications. The attacker could then extract sensitive information or potentially modify data within these internal systems. In a Multisite environment, the vulnerability could be exploited across multiple sites within the same WordPress installation, significantly expanding the potential impact. While the CVSS score is low, the ability to bypass internal network restrictions and access sensitive data warrants immediate attention.

1. Reserved2025-01-16
2. Published2025-01-25
3. Modified2025-01-27
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-13450 is to upgrade the Contact Form by Bit Form plugin to version 2.18.0 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider temporarily disabling the Webhooks integration feature within the plugin's settings. As a further precaution, implement a Web Application Firewall (WAF) with rules to restrict outbound requests from the WordPress application to only trusted domains. Monitor WordPress access logs for unusual outbound requests originating from the plugin’s Webhooks functionality.

Plugin rating