This vulnerability (CVE-2024-35678) in BestWebSoft Contact Form to DB plugin is due to improper neutralization of special elements in SQL commands (CWE-89), commonly known as SQL Injection. It affects all versions up to 1.7.2. The CVSS 3.1 score is 8.5 (high), with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed, with high confidentiality impact and low availability impact, but no integrity impact. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation could allow an attacker with low privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin functionality to trusted users only and monitor for unusual database activity related to the plugin. Avoid exposing the vulnerable plugin to untrusted networks or users. Do not rely on generic mitigations unless specifically recommended by the vendor.