CVE-2024-13450

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.

• CWE-918

• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/AdminFormHandler.php#L1072Product
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/AdminFormHandler.php#L1312Product
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L190Product
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L51Product
• https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L96Product
• https://plugins.trac.wordpress.org/changeset/3227207/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d935f4c5-5d69-42d9-be22-7a44d9aa885a?source=cveThird Party Advisory

Published

Jan 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13445The Elementor Website Builder – More Than Just a Page Builde…5.4
• CVE-2024-13446The Workreap plugin for WordPress is vulnerable to privilege…9.8
• CVE-2024-13447The WP Hotel Booking plugin for WordPress is vulnerable to u…4.3
• CVE-2024-13448The ThemeREX Addons plugin for WordPress is vulnerable to ar…9.8
• CVE-2024-13449The Boom Fest plugin for WordPress is vulnerable to unauthor…4.3
• CVE-2024-1345Weak MySQL database root password in LaborOfficeFree affects…5.5
• CVE-2024-13451The Contact Form by Bit Form: Multi Step Form, Calculation C…7.5
• CVE-2024-13452The Contact Form by Supsystic plugin for WordPress is vulner…6.1
• CVE-2024-13453The The Contact Form & SMTP Plugin for WordPress by PirateFo…7.3
• CVE-2024-13454Weak encryption algorithm in Easy-RSA version 3.0.5 through …5.3
• CVE-2024-13455The igumbi Online Booking plugin for WordPress is vulnerable…5.4
• CVE-2024-13456The Easy Quiz Maker plugin for WordPress is vulnerable to St…5.4