Lucene search

WpvulndbWPVDB-ID:8A9A2D91-12B7-4DB7-B224-61E0B6DF3E42

HistoryMay 13, 2024 - 12:00 a.m.

Simple Basic Contact Form < 20240511 - Unauthenticated Arbitrary Shortcode Execution

2024-05-1300:00:00

wpscan.com

contact form

wordpress

vulnerability

shortcode

unauthenticated

arbitrary execution

plugin

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.6%

JSON

Description The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.

CPENameOperatorVersion
eq20240511

CPE	Name	Operator	Version
		eq	20240511

References

www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.6%

JSON

Related for WPVDB-ID:8A9A2D91-12B7-4DB7-B224-61E0B6DF3E42