CVE-2024-13450 is a CWE-918 SSRF vulnerability in the Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder WordPress plugin by bitpressadmin. Authenticated attackers with Administrator privileges can abuse the Webhooks integration to make server-side HTTP requests to arbitrary locations. This can potentially allow querying or modifying internal services accessible from the web application server. The issue affects all plugin versions up to 2.17.4 and is also exploitable in WordPress Multisite setups. The CVSS 3.1 base score is 3.8 (low severity) with network attack vector, low attack complexity, and high privileges required.

The vulnerability allows an authenticated administrator to cause the server to make arbitrary HTTP requests, which could lead to information disclosure or modification of internal services accessible from the server. The impact is limited by the requirement for administrator-level privileges and the low CVSS score indicates limited confidentiality and integrity impact with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or limiting the use of the Webhooks integration in the plugin to reduce exposure.