CVE-2024-4144

{"id": "CVE-2024-4144", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-4144", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-05-14T16:15:29.671711Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "wpkube", "product": "Simple Basic Contact Form", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20240502"}], "defaultStatus": "unaffected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:wpkube:simple_basic_contact_form:-:*:*:*:*:wordpress:*:*"], "vendor": "wpkube", "product": "simple_basic_contact_form", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "20240502"}], "defaultStatus": "unknown"}]}], "published": "2024-05-14T16:17:33.483", "references": [{"url": "https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3085036/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://plugins.trac.wordpress.org/changeset/3085036/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment."}, {"lang": "es", "value": "El complemento Simple Basic Contact Form para WordPress para WordPress es vulnerable a la ejecuci\u00f3n de c\u00f3digos cortos arbitrarios en todas las versiones hasta la 20240502 incluida. Esto permite a atacantes no autenticados ejecutar c\u00f3digos cortos arbitrarios. La gravedad y la explotabilidad dependen de la funcionalidad de otros complementos instalados en el entorno."}], "lastModified": "2026-06-17T08:01:13.023", "sourceIdentifier": "security@wordfence.com"}