Arbitrary File Read and Deletion Vulnerability in Contact Form Plugin
CVE-2024-7777
9CRITICAL
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 20 August 2024
What is CVE-2024-7777?
The Contact Form by Bit Form plugin on WordPress is susceptible to vulnerabilities in multiple functions that lack proper file path validation. Versions ranging from 2.0 to 2.13.9 are impacted, allowing authenticated attackers with Administrator-level access to read and delete arbitrary files on the server. This vulnerability poses significant risks, as deleting critical files such as wp-config.php can lead to remote code execution, compromising the security and integrity of the WordPress site.
Affected Version(s)
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 <= 2.13.9