Unrestricted File Upload Vulnerability Could Lead to Code Injection
CVE-2024-47319

8HIGH

Key Information:

Vendor
WordPress
Status
Bit Form – Contact Form Plugin
Vendor
CVE Published:
5 October 2024

Summary

The vulnerability in Bit Apps' Bit Form – Contact Form Plugin allows for unrestricted upload of files with potentially malicious types. This flaw can lead to code injection, posing significant security risks to systems utilizing versions from n/a through 2.13.10. Attackers may exploit this vulnerability to upload dangerous files, enabling unauthorized access or manipulation of application functionality, thereby affecting the integrity and security of the system.

Affected Version(s)

Bit Form – Contact Form Plugin <= 2.13.10

References

https://patchstack.com/database/vulnerability/bit-form/wo...
vdb-entry

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Certus Cybersecurity (Patchstack Alliance)
.