CVE-2024-7780: Bitapps Contact Form Builder SQLi Flaw

CVE-2024-7780 Overview

CVE-2024-7780 is a SQL injection vulnerability in the Contact Form by Bit Form plugin for WordPress, developed by Bitapps. The flaw affects versions 2.0 through 2.13.9 of the bit-form plugin. The vulnerability originates from insufficient escaping of the user-supplied id parameter and inadequate preparation of the underlying SQL query [CWE-89]. Authenticated attackers with Administrator-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database.

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session tokens, and stored form submissions.

Affected Products

Bitapps Contact Form Builder (Bit Form) plugin for WordPress, versions 2.0 through 2.13.9
WordPress installations using the vulnerable bit-form plugin
Sites where Administrator accounts may be compromised or shared across untrusted operators

Discovery Timeline

2024-08-20 - CVE-2024-7780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7780

Vulnerability Analysis

The Bit Form plugin exposes several administrative AJAX endpoints that accept an id parameter and pass it into SQL queries without proper sanitization or parameterized preparation. Wordfence identified affected code paths in includes/Admin/AdminAjax.php, includes/Admin/Form/AdminFormHandler.php, and includes/Core/Messages/EmailTemplateHandler.php in version 2.13.6 and earlier. Attackers who already hold Administrator privileges can craft an id value containing additional SQL syntax. The injected clauses execute in the context of the WordPress database user, allowing arbitrary read access to any table.

Exploitation requires authentication, which limits mass exploitation. However, WordPress environments frequently host multiple administrators, agency-managed accounts, or compromised credentials from unrelated breaches. In multi-admin deployments, this vulnerability becomes a stepping stone for privilege abuse and data exfiltration beyond what the WordPress role model normally permits.

Root Cause

The root cause is a failure to use prepared statements or proper escaping when incorporating the id request parameter into SQL queries. The plugin concatenates the untrusted value directly into query strings, bypassing WordPress's $wpdb->prepare() safeguards. See the WordPress Bit Form Code Review for the vulnerable source.

Attack Vector

An authenticated Administrator issues a crafted request to an affected AJAX action or form handler, supplying a malicious id parameter. The plugin embeds the value into a SQL statement, and the appended payload executes alongside the intended query. Attackers typically use UNION SELECT or stacked query techniques to enumerate database schemas and extract rows from wp_users, wp_usermeta, or plugin-managed tables containing form submissions.

Detection Methods for CVE-2024-7780

Indicators of Compromise

Unexpected AJAX requests to Bit Form endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or comment sequences (--, #) in the id parameter
Web server access logs showing long or URL-encoded id values sent to admin-ajax.php with action parameters belonging to the Bit Form plugin
Database query logs revealing malformed or nested SELECT statements originating from the WordPress database user

Detection Strategies

Deploy a web application firewall rule that inspects Bit Form AJAX actions and blocks non-numeric or SQL-metacharacter values in the id parameter
Enable MySQL general query logging temporarily to identify anomalous queries containing UNION or subselects issued by the WordPress user
Correlate administrator session activity with outbound data transfer volumes to identify potential exfiltration

Monitoring Recommendations

Alert on any administrator account issuing more than a baseline number of Bit Form AJAX requests within a short window
Monitor changes to wp_users and wp_options tables outside of scheduled maintenance windows
Track plugin version inventory across managed WordPress sites and flag any installation still running Bit Form 2.13.9 or earlier

How to Mitigate CVE-2024-7780

Immediate Actions Required

Update the Contact Form by Bit Form plugin to version 2.13.10 or later on every affected WordPress site
Audit Administrator accounts, remove unused privileges, and enforce multi-factor authentication for all admin logins
Rotate WordPress secret keys, database credentials, and administrator passwords if exploitation is suspected

Patch Information

Bitapps addressed the vulnerability in releases following version 2.13.9. Site owners should upgrade to the latest available version of the bit-form plugin via the WordPress plugin repository. Review the Wordfence Vulnerability Report for confirmation of fixed versions and additional advisory detail.

Workarounds

Temporarily deactivate the Bit Form plugin until the patched version is installed
Restrict access to /wp-admin/admin-ajax.php at the network layer to trusted administrative IP ranges
Apply a WAF virtual patch that rejects non-integer values in the id parameter for Bit Form actions

bash

# Example WP-CLI command to update the plugin across managed sites
wp plugin update bit-form --version=latest
wp plugin list --name=bit-form --fields=name,status,version