CVE-2024-4144 is a code injection vulnerability (CWE-94) in the Simple Basic Contact Form plugin for WordPress, affecting all versions up to 20240502. It permits unauthenticated attackers to execute arbitrary shortcodes within the plugin context. The severity and exploitability depend on the presence and functionality of other plugins installed in the WordPress environment. The vulnerability has a CVSS 3.1 score of 6.5 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or vendor advisory is currently available to confirm remediation status.

An unauthenticated attacker can execute arbitrary shortcodes via the vulnerable plugin, which may lead to limited integrity and availability impacts. The actual impact depends on other plugins installed and their capabilities. There is no direct confidentiality impact reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the Simple Basic Contact Form plugin if it is not essential. Monitor official wpkube communications and WordPress plugin repositories for updates or patches addressing this vulnerability.