CVE-2024-35747: 
WordPress vulnerability analysis and mitigation

A vulnerability identified as CVE-2024-35747 was discovered in the WordPress Contact Form Builder, Contact Widget plugin affecting versions up to 2.1.7. The vulnerability is classified as an Improper Restriction of Excessive Authentication Attempts that allows for Functionality Bypass. The issue was initially reported on January 20, 2024, and was publicly disclosed on June 6, 2024 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, and requires no user interaction. The vulnerability is categorized under CWE-307 (Improper Restriction of Excessive Authentication Attempts) (NVD).

The vulnerability allows unauthenticated attackers to perform functionality bypass in the affected WordPress plugin. The security impact is considered low to medium, primarily affecting the integrity of the system with no direct impact on confidentiality or availability (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, requiring low attack complexity. No user interaction is needed for exploitation, making it relatively straightforward to exploit (Wordfence).

As of the latest reports, no official fix is available for this vulnerability. Users of the Contact Form Builder, Contact Widget plugin version 2.1.7 or earlier should consider implementing additional security measures or exploring alternative contact form solutions (Patchstack).