CVE-2024-31302: Contact Form Email Information Disclosure

CVE-2024-31302 Overview

CVE-2024-31302 is an information disclosure vulnerability in the CodePeople Contact Form Email plugin for WordPress. The flaw affects all versions up to and including 1.3.44. An unauthorized network-based actor can access sensitive information exposed by the plugin without any authentication or user interaction. The weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Remote unauthenticated attackers can retrieve sensitive data managed by the Contact Form Email plugin on affected WordPress sites, potentially exposing form submissions and configuration details.

Affected Products

CodePeople Contact Form Email plugin for WordPress
All versions from initial release through 1.3.44
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-04-10 - CVE-2024-31302 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31302

Vulnerability Analysis

The Contact Form Email plugin exposes sensitive information to actors who should not have access to it. The vulnerability is remotely reachable over the network, requires no privileges, and needs no user interaction. Only data confidentiality is affected; integrity and availability of the WordPress instance remain intact.

Sensitive data managed by contact form plugins commonly includes submitted form values, email routing metadata, plugin configuration, and internal identifiers. Exposure of any of these elements can support reconnaissance for follow-on attacks such as phishing or credential targeting.

Root Cause

The root cause is missing or insufficient access control around plugin resources that hold sensitive information. Requests that should require authentication, capability checks, or nonce validation return data to unauthenticated callers. The Patchstack advisory tracks this as a sensitive data exposure issue in the plugin.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin. Because no authentication or user interaction is required, exploitation can be automated across large numbers of WordPress hosts. No public proof-of-concept exploit is currently listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog. See the Patchstack Vulnerability Report for the vendor-tracked technical details.

Detection Methods for CVE-2024-31302

Indicators of Compromise

Unauthenticated HTTP GET or POST requests targeting Contact Form Email plugin endpoints under /wp-content/plugins/contact-form-to-email/ or associated admin-ajax.php actions.
Repeated requests from a single source IP enumerating plugin resources without a valid WordPress session cookie.
Web server responses returning JSON, serialized, or CSV data from plugin endpoints to unauthenticated clients.

Detection Strategies

Inventory WordPress sites and identify installations of the CodePeople Contact Form Email plugin at version 1.3.44 or earlier.
Review web server access logs for anomalous access patterns to plugin URIs, especially bursts of requests from non-browser user agents.
Deploy web application firewall (WAF) rules that alert on unauthenticated access to plugin endpoints that should require capability checks.

Monitoring Recommendations

Forward WordPress access logs and application logs to a centralized analytics platform for correlation and retention.
Alert on outbound data volumes from WordPress hosts that deviate from historical baselines, which may indicate scraping of exposed data.
Monitor for new plugin installations and version changes across managed WordPress fleets to catch reintroduction of vulnerable builds.

How to Mitigate CVE-2024-31302

Immediate Actions Required

Identify all WordPress instances running CodePeople Contact Form Email and confirm the installed version.
Update the plugin to a version later than 1.3.44 once the vendor publishes a fixed release, or remove the plugin if a patched version is not yet available.
Restrict administrative and plugin endpoints behind authenticated access and a WAF while remediation is in progress.

Patch Information

The vulnerability affects Contact Form Email through version 1.3.44. Consult the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply updates through the WordPress plugin manager or via a managed update process.

Workarounds

Disable and remove the Contact Form Email plugin until a patched release is deployed.
Use WAF rules or web server access controls to block unauthenticated requests to the plugin's endpoints and admin-ajax actions.
Rotate any secrets, API keys, or credentials that may have been included in contact form submissions or plugin configuration.

bash

# Example: block unauthenticated access to the plugin path at the web server
# Nginx snippet
location ~* /wp-content/plugins/contact-form-to-email/ {
    deny all;
    return 403;
}