CVE-2024-4144CWE-94

Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution

Medium · published May 14, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00662 · 51.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-05-14T05:33Z
EPSS history
Timeline
  • 14 MAY 05:33Z
    Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution
    cvelistv5