Sensitive Information Exposure in Bit Form Contact Form Plugin for WordPress
CVE-2024-13451
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 2 July 2025
What is CVE-2024-13451?
The Bit Form Contact Form plugin for WordPress is susceptible to a Sensitive Information Exposure vulnerability due to inadequate directory listing prevention and a lack of file name randomization. This flaw exists in all versions up to and including 2.17.4, allowing unauthenticated attackers to access and extract sensitive files uploaded via forms. While a partial patch was introduced in version 2.17.5, users are advised to upgrade promptly to mitigate potential security risks.
Affected Version(s)
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder * <= 2.17.5