CVE-2024-13453
Published: 30 January 2025
Summary
CVE-2024-13453 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13453 is an arbitrary shortcode execution vulnerability affecting the Contact Form & SMTP Plugin for WordPress by PirateForms, in all versions up to and including 2.6.0. The flaw stems from the plugin allowing execution of an action that fails to properly validate a user-supplied value before passing it to the do_shortcode function, enabling attackers to inject and execute arbitrary WordPress shortcodes. It has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-94 (Improper Control of Generation of Code).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By targeting the vulnerable action, they can execute arbitrary shortcodes, potentially leading to low-level impacts on confidentiality, integrity, and availability, such as data disclosure, modification of site content, or denial-of-service effects depending on the shortcodes available in the WordPress environment.
Advisories, including those from Wordfence and WordPress plugin trac repositories, point to code changes in the Gutenberg block handler (class-pirateforms-gutenberg.php) as the fix, with a relevant changeset between revisions 3219203 and 3225666 demonstrating the patch. Security practitioners should update to a version beyond 2.6.0 to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51610
Vulnerability details
The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0. This is due to the software allowing users to execute an action…
more
that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing WordPress plugin via unsanitized input to do_shortcode, matching T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely patching of the specific input validation flaw in PirateForms versions up to 2.6.0, as evidenced by the vendor's code changes in the Gutenberg block handler.
Mandates validation of user-supplied inputs before processing by functions like do_shortcode, directly preventing arbitrary shortcode execution.
Provides vulnerability scanning and monitoring to identify and address this CVE in WordPress plugins like PirateForms through advisories from sources such as Wordfence.