CVE-2024-4144: 
WordPress vulnerability analysis and mitigation

The Simple Basic Contact Form plugin for WordPress is affected by a vulnerability (CVE-2024-4144) that allows arbitrary shortcode execution in all versions up to and including 20240502. This security flaw was discovered and reported by researcher stealthcopter, with public disclosure occurring on May 13, 2024 (Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction (NVD).

The vulnerability enables unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment. The actual severity and impact of this vulnerability can vary depending on the functionality provided by other plugins installed in the WordPress environment (NVD).

The vulnerability is exploitable by unauthenticated attackers and requires low attack complexity. The attack vector is network-accessible, making it possible to exploit remotely without requiring user interaction (Wordfence).

Users should update their Simple Basic Contact Form plugin to a version newer than 20240502 to address this vulnerability. The fix has been implemented in the WordPress plugin repository (WordPress Plugin).