CVE-2024-13450lowCWE-918

CVE-2024-13450: low-severity vulnerability in bitpressadmin Bit Form – Custom Contact Form…

Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery

Published · Updated

Follow this CVE+ Monitor Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.8epss 0.4%
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected products
bitpressadmin · Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder
Related CVEs — bitpressadmin Bit Form – Custom Contact Form…

In the same product, most dangerous first.

CVE-2024-6123HIGHBit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File UploadEPSS 1.0%CVE-2025-6679CRITICALContact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2024-9507MEDIUMContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File ReadEPSS 0.5%CVE-2024-1640MEDIUMContact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission AlterationEPSS 0.5%CVE-2024-12190MEDIUMContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission DisclosureEPSS 0.5%CVE-2025-14901MEDIUMBit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow ReplayEPSS 0.4%