CVE-2024-47335

Overview

CVE-2024-47335 is an SQL injection vulnerability found in the Bit Form plugin (versions ≤ 2.13.11) for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command, allowing attackers to inject malicious queries.

Exploitation

Attackers can exploit this vulnerability without authentication, as it does not require any special privileges. The attack vector is network-based, making it exploitable remotely. Given the widespread use of the Bit Form plugin, this vulnerability is a target for mass-exploit campaigns that aim to compromise thousands of websites simultaneously [1].

Impact

Successful exploitation could allow an attacker to directly interact with the underlying database. This includes the ability to extract sensitive information, modify data, or perform other unauthorized actions that compromise the confidentiality and integrity of the site [1].

Mitigation

The vulnerability has been addressed in Bit Form version 2.13.12. Users are strongly advised to update immediately. For those unable to update, alternative mitigation steps include consulting with a hosting provider or disabling the plugin until the update can be applied [1].