Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload

CVE-2024-6123

Summary

The Bit Form plugin for WordPress presents a significant vulnerability involving arbitrary file uploads due to inadequate file type validation in the 'iconUpload' function. This flaw affects all versions of the plugin up to and including 2.13.3. When exploited by authenticated users with administrator-level permissions, it allows the potential for unauthorized uploads of arbitrary files to the server. Such actions could lead to serious issues, including remote code execution, posing a substantial risk to the integrity and security of affected WordPress sites. Site administrators are advised to review their plugin versions and consider applying necessary security measures.

References