Contact Form by Bit Form <= 2.17.4 - Falsificación de Solicitud del Servidor (SSRF) Autenticada (Administrador+)

The SSRF vulnerability in Contact Form by Bit Form allows an authenticated administrator to craft malicious web requests originating from the WordPress application. This means an attacker could potentially query internal services that are not directly accessible from the outside world, such as internal APIs, databases, or even other internal web applications. The attacker could then extract sensitive information or potentially modify data within these internal systems. In a Multisite environment, the vulnerability could be exploited across multiple sites within the same WordPress installation, significantly expanding the potential impact. While the CVSS score is low, the ability to bypass internal network restrictions and access sensitive data warrants immediate attention.

WordPress websites utilizing the Contact Form by Bit Form plugin, particularly those with administrator accounts and internal services accessible via HTTP or HTTPS. Shared hosting environments where multiple WordPress sites share the same server infrastructure are also at increased risk, as a compromised administrator account on one site could potentially be used to exploit the vulnerability on other sites.

• wordpress / composer / npm:

grep -r 'Webhook_url' /var/www/html/wp-content/plugins/contact-form-by-bit-form/*

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/contact-form-by-bit-form/webhook.php | grep -i 'server:'

1. 2025-01-25Disclosure

   disclosure

1. Reservado2025-01-16
2. Publicada2025-01-25
3. Modificada2025-01-27
4. EPSS actualizado2026-04-02

The primary mitigation for CVE-2024-13450 is to upgrade the Contact Form by Bit Form plugin to version 2.18.0 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider temporarily disabling the Webhooks integration feature within the plugin's settings. As a further precaution, implement a Web Application Firewall (WAF) with rules to restrict outbound requests from the WordPress application to only trusted domains. Monitor WordPress access logs for unusual outbound requests originating from the plugin’s Webhooks functionality.

Valoración del plugin