CVE-2024-35678: Contact Form To DB SQLi Vulnerability

CVE-2024-35678 Overview

CVE-2024-35678 is a SQL injection vulnerability in the BestWebSoft Contact Form to DB WordPress plugin. The flaw affects all plugin versions up to and including 1.7.2. It stems from improper neutralization of special elements used in an SQL command [CWE-89]. Authenticated attackers with low privileges can inject arbitrary SQL statements into database queries over the network. Successful exploitation compromises confidentiality, integrity, and availability of the WordPress backend database.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, enabling data theft, modification of stored records, and potential full site takeover through credential extraction.

Affected Products

BestWebSoft Contact Form to DB plugin for WordPress
All versions from n/a through 1.7.2
WordPress sites using the plugin to store contact form submissions

Discovery Timeline

2024-06-08 - CVE-2024-35678 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35678

Vulnerability Analysis

The Contact Form to DB plugin stores WordPress contact form submissions in the database and provides administrative views for reviewing entries. The plugin constructs SQL queries using input that is not properly sanitized or parameterized. Attackers holding a low-privilege authenticated session can supply crafted values that break out of the intended query context. Injected SQL executes with the privileges of the WordPress database user, which typically has full access to the site's schema.

The vulnerability enables extraction of sensitive data including wp_users password hashes, session tokens, and API secrets stored in wp_options. Attackers can also modify records, insert malicious administrative accounts, or drop tables. The network attack vector and low complexity make exploitation practical against any exposed WordPress installation running the vulnerable plugin.

Root Cause

The root cause is failure to use prepared statements or the WordPress $wpdb->prepare() method when incorporating user-controlled input into SQL queries. Direct string concatenation of unsanitized parameters into query strings allows syntactic escape from the intended context. This is a textbook CWE-89 flaw where input validation and output encoding controls are absent from database-facing code paths.

Attack Vector

An attacker authenticates to the target WordPress site using any account with at least contributor-level access. The attacker then submits crafted parameters to a plugin endpoint that processes form submission data or administrative filtering. The malicious payload contains SQL metacharacters and UNION-based or time-based blind injection syntax. The plugin passes the payload directly into a query, and the database server executes the injected statement.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Patchstack SQL Injection Advisory for additional technical details.

Detection Methods for CVE-2024-35678

Indicators of Compromise

Unexpected UNION SELECT, SLEEP(), or BENCHMARK() substrings in HTTP request parameters targeting /wp-admin/admin.php or /wp-admin/admin-ajax.php endpoints associated with the plugin
New WordPress administrator accounts created without a corresponding audit trail in the wp_users table
Anomalous read volume against wp_users, wp_usermeta, or wp_options from the web application database user
Web server logs showing repeated authenticated requests with SQL syntax in query strings or POST bodies

Detection Strategies

Deploy web application firewall rules that flag SQL keywords in parameters submitted to Contact Form to DB plugin endpoints
Enable MySQL general query logging temporarily to capture queries containing suspicious tautologies such as OR 1=1 or stacked statements
Correlate authenticated WordPress session activity against database query patterns to identify low-privilege users issuing high-impact reads

Monitoring Recommendations

Alert on creation of new administrator role users through direct database writes rather than through the WordPress admin UI
Monitor plugin version inventory across WordPress installations and flag any host running Contact Form to DB 1.7.2 or earlier
Track outbound data transfer volumes from web servers to identify bulk exfiltration following successful injection

How to Mitigate CVE-2024-35678

Immediate Actions Required

Update the Contact Form to DB plugin to a version later than 1.7.2 as soon as a patched release is available from BestWebSoft
Audit WordPress user accounts and remove any unauthorized administrator or editor roles created since June 2024
Rotate all WordPress passwords, API keys, and secrets stored in wp_options if compromise is suspected
Review database query logs for evidence of exploitation attempts against the plugin

Patch Information

Consult the Patchstack SQL Injection Advisory for the latest vendor patch status. Administrators should subscribe to BestWebSoft security notifications and apply updates through the WordPress plugin management interface once a fixed version is published.

Workarounds

Deactivate and remove the Contact Form to DB plugin until a patched version is installed
Restrict low-privilege authenticated access to plugin endpoints using WordPress role management or a web application firewall rule set
Apply the principle of least privilege to the WordPress database user by revoking DROP, ALTER, and CREATE USER privileges where not required

bash

# Example: restrict WordPress database user privileges in MySQL
REVOKE DROP, ALTER, CREATE, GRANT OPTION ON wordpress.* FROM 'wp_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;