Arbitrary File Read and Deletion Vulnerability in Contact Form Plugin
CVE-2024-7777
9CRITICAL
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 20 August 2024
Summary
The Contact Form by Bit Form plugin on WordPress is susceptible to vulnerabilities in multiple functions that lack proper file path validation. Versions ranging from 2.0 to 2.13.9 are impacted, allowing authenticated attackers with Administrator-level access to read and delete arbitrary files on the server. This vulnerability poses significant risks, as deleting critical files such as wp-config.php can lead to remote code execution, compromising the security and integrity of the WordPress site.
Affected Version(s)
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 <= 2.13.9
References
CVSS V3.1
Score:
9
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
TANG Cheuk Hei