CVE-2024-35747: Contact Form Builder Auth Bypass Vulnerability

CVE-2024-35747 Overview

CVE-2024-35747 affects the wpdevart Contact Form Builder, Contact Widget plugin for WordPress. The flaw stems from improper restriction of excessive authentication attempts [CWE-307], enabling a functionality bypass on affected installations. All plugin versions up to and including 2.1.7 are impacted.

The issue is remotely exploitable over the network without authentication or user interaction. Attackers can abuse the missing rate-limiting controls to bypass protections that the plugin should enforce against repeated attempts.

Critical Impact

Unauthenticated remote attackers can bypass plugin functionality by issuing repeated requests without triggering lockout or throttling controls, exposing the integrity of contact form workflows.

Affected Products

• wpdevart Contact Form Builder, Contact Widget plugin for WordPress
• All versions from n/a through 2.1.7
• WordPress sites deploying the vulnerable plugin

Discovery Timeline

• 2024-06-10 - CVE-2024-35747 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35747

Vulnerability Analysis

The Contact Form Builder, Contact Widget plugin fails to enforce restrictions on repeated authentication or verification attempts. Under [CWE-307], applications must throttle, lock, or otherwise limit sequential attempts against sensitive functions.

Because the plugin does not implement such controls, an attacker can submit unlimited requests to protected endpoints. This allows adversaries to bypass a security control the plugin is supposed to enforce, undermining the integrity of form submission or authentication logic.

The vulnerability does not disclose confidential data or crash the service directly. Its impact is limited to integrity, aligning with the low integrity impact score in the CVSS vector.

Root Cause

The root cause is missing or insufficient logic to detect and block excessive attempts against a protected function within the plugin. Without a counter, cooldown, CAPTCHA, or lockout mechanism, the endpoint accepts arbitrary volumes of requests from the same source.

This class of weakness is common in WordPress plugins where developers rely on client-side controls or trust that the surrounding request context will limit abuse. In this case, the server-side handler does not validate attempt frequency before proceeding.

Attack Vector

Exploitation requires only network access to the target WordPress site. No credentials or user interaction are needed. An attacker sends repeated crafted HTTP requests to the plugin endpoint, bypassing the intended restriction on the number of attempts.

The vulnerability is described in prose in the Patchstack Vulnerability Report. No public proof-of-concept exploit is currently listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-35747

Indicators of Compromise

• High-volume POST or GET requests to Contact Form Builder plugin endpoints from a single IP or narrow IP range.
• Repeated requests with sequential or programmatically generated parameter values against form or widget handlers.
• Unusual spikes in form submission logs without corresponding legitimate user traffic.

Detection Strategies

• Inspect WordPress access logs for burst patterns targeting /wp-content/plugins/contact-forms-builder/ or related AJAX action names.
• Correlate web application firewall (WAF) events with plugin endpoint activity to surface brute-force or enumeration attempts.
• Baseline normal form submission rates and alert on statistical deviations that suggest automated abuse.

Monitoring Recommendations

• Forward web server and WordPress audit logs to a centralized analytics platform for retention and correlation.
• Configure alerts on repeated 200 responses from plugin endpoints originating from non-browser user agents.
• Track plugin version inventory across managed WordPress sites to identify installations still running 2.1.7 or earlier.

How to Mitigate CVE-2024-35747

Immediate Actions Required

• Update the Contact Form Builder, Contact Widget plugin to a release later than 2.1.7 as soon as a fixed version is available from wpdevart.
• If a fixed version is not yet available, deactivate and remove the plugin from production WordPress sites.
• Review web server logs for evidence of prior abuse against plugin endpoints.

Patch Information

Refer to the Patchstack Vulnerability Report for the vendor patch status. Administrators should monitor the wpdevart plugin page and the WordPress plugin repository for updates addressing this issue.

Workarounds

• Place the affected endpoint behind a WAF rule that enforces per-IP rate limiting on plugin URLs.
• Add server-level throttling using tools such as mod_evasive, fail2ban, or NGINX limit_req directives to cap requests per second.
• Enable CAPTCHA or challenge-response protections in front of the form to disrupt automated attempts.
• Restrict access to plugin endpoints by IP allowlist where the form is only used internally.

# NGINX per-IP rate limit example for the vulnerable plugin path
http {
    limit_req_zone $binary_remote_addr zone=cfb_limit:10m rate=5r/m;

    server {
        location ~* /wp-content/plugins/contact-forms-builder/ {
            limit_req zone=cfb_limit burst=5 nodelay;
            limit_req_status 429;
        }
    }
}