CVE-2024-7702 Overview
CVE-2024-7702 is a SQL Injection vulnerability in the Contact Form by Bit Form plugin for WordPress. The flaw affects versions 2.0 through 2.13.9 and stems from insufficient escaping of the entryID parameter combined with improper SQL query preparation in AdminAjax.php. Authenticated attackers with Administrator-level access or higher can append arbitrary SQL statements to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and application secrets. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database, leading to full disclosure of stored data.
Affected Products
- Bitapps Contact Form Builder (bit-form) plugin for WordPress, versions 2.0 through 2.13.9
- WordPress installations with the Bit Form plugin active
- Sites where non-super-admin accounts hold Administrator-level roles
Discovery Timeline
- 2024-08-20 - CVE-2024-7702 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7702
Vulnerability Analysis
The vulnerability resides in the AdminAjax.php handler at line 944 of the Bit Form plugin trunk. The handler accepts an entryID parameter from an authenticated AJAX request and concatenates it into an SQL statement without proper sanitization or parameterized binding. Because the query is not built with prepared statements, an attacker controlling entryID can break out of the intended query context and append additional SQL clauses such as UNION SELECT.
The impact extends beyond data disclosure. Depending on database privileges assigned to the WordPress user, attackers may read arbitrary tables including wp_users, wp_usermeta, and wp_options, exposing password hashes, secret keys, and API tokens. In multi-tenant hosting environments, this can accelerate lateral movement across sites sharing the same database instance.
Root Cause
The root cause is missing input escaping and the absence of $wpdb->prepare() on the SQL statement that consumes entryID. Developer-supplied concatenation replaces the parameter binding that WordPress's database abstraction layer would normally enforce. See the WordPress Plugin Code Review for the vulnerable code location.
Attack Vector
Exploitation requires an authenticated session at Administrator level or higher. The attacker sends a crafted AJAX request to the admin endpoint, embedding SQL payload characters within the entryID parameter. The vulnerable handler concatenates the payload into the query and returns results reflecting the injected clauses. Refer to the Wordfence Vulnerability Report for further technical detail.
Detection Methods for CVE-2024-7702
Indicators of Compromise
- Unexpected POST requests to wp-admin/admin-ajax.php containing the Bit Form action and an entryID parameter with SQL metacharacters such as single quotes, UNION, SELECT, or SLEEP.
- Anomalous read access to wp_users, wp_usermeta, or wp_options tables originating from the WordPress application user.
- Administrator sessions issuing bursts of AJAX requests with varying entryID payload lengths.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect the entryID parameter for SQL syntax tokens.
- Enable MySQL general query logging or slow query logging and alert on queries referencing plugin tables that contain UNION, subqueries, or information_schema.
- Correlate WordPress audit logs with database query logs to attribute suspicious SQL to specific administrator accounts.
Monitoring Recommendations
- Monitor admin-ajax.php traffic volume per authenticated administrator for baseline deviation.
- Alert on new or unusual administrator accounts created immediately before Bit Form AJAX activity.
- Track outbound data transfer from the WordPress host following administrator logins, which may indicate database exfiltration.
How to Mitigate CVE-2024-7702
Immediate Actions Required
- Update the Contact Form by Bit Form plugin to version 2.13.10 or later on all WordPress sites.
- Audit all Administrator-level accounts and remove any that are unused, dormant, or unnecessary.
- Rotate WordPress secret keys in wp-config.php and reset administrator passwords if compromise is suspected.
- Review database logs for evidence of UNION-based extraction targeting wp_users or wp_options.
Patch Information
The vendor addressed the flaw in versions above 2.13.9. Administrators should apply the fix through the WordPress plugin updater or by replacing the plugin files via SFTP. Confirm the patched version by inspecting the plugin header in bit-form.php after deployment. See the Wordfence Vulnerability Report for advisory details.
Workarounds
- Temporarily deactivate the Bit Form plugin until the patched version is applied.
- Restrict access to wp-admin by source IP address through web server or WAF rules.
- Enforce multi-factor authentication for all Administrator accounts to reduce the risk of credential-based access.
- Apply WAF signatures that block SQL metacharacters in the entryID request parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
