CVE-2024-13453

CVE-2024-13453 is an arbitrary shortcode execution vulnerability affecting the Contact Form & SMTP Plugin for WordPress by PirateForms, in all versions up to and including 2.6.0. The flaw stems from the plugin allowing execution of an action that fails to properly validate a user-supplied value before passing it to the do_shortcode function, enabling attackers to inject and execute arbitrary WordPress shortcodes. It has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-94 (Improper Control of Generation of Code).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By targeting the vulnerable action, they can execute arbitrary shortcodes, potentially leading to low-level impacts on confidentiality, integrity, and availability, such as data disclosure, modification of site content, or denial-of-service effects depending on the shortcodes available in the WordPress environment.

Advisories, including those from Wordfence and WordPress plugin trac repositories, point to code changes in the Gutenberg block handler (class-pirateforms-gutenberg.php) as the fix, with a relevant changeset between revisions 3219203 and 3225666 demonstrating the patch. Security practitioners should update to a version beyond 2.6.0 to mitigate the issue.