CVE-2021-24704

CVE-2021-24704 is a high-severity SQL injection and CSRF vulnerability affecting the Orange Form WordPress plugin through version 1.0. The vulnerability stems from an unsanitized parameter in an unprepared SQL query within the process_bulk_action() function, combined with a lack of CSRF protection. This allows an attacker to trick a logged-in administrator into deleting arbitrary posts or performing other unauthorized database actions. With a CVSS score of 8.8 (High), the attack vector is network-based with low complexity, requiring user interaction but leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.