CVE-2024-1640

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-16415.4The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check o CVE-2024-16424.3The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery CVE-2024-16439.1By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data w CVE-2024-16448.8Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI.CVE-2024-16454.3The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrati CVE-2024-16468.2parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks CVE-2024-16477.5Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doe CVE-2024-16487.5electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application CVE-2024-16494.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj CVE-2024-16504.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj CVE-2024-16519.8Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to inse CVE-2024-16524.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj