PT-2024-38572 · Bit Form · The Contact Form By Bit Form

Siunam

+1

·

Published

2024-05-16

·

Updated

2024-08-26

·

CVE-2024-7777

CVSS v3.1

9.0

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Name of the Vulnerable Software and Affected Versions The Contact Form by Bit Form versions 2.0 through 2.13.9
Description The issue is related to insufficient file path validation in multiple functions, allowing authenticated attackers with Administrator-level access and above to read and delete arbitrary files on the server. This can lead to remote code execution when the right file is deleted, such as wp-config.php.
Recommendations For versions 2.0 through 2.13.9, update to a version that fixes the insufficient file path validation issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-7777

Affected Products

The Contact Form By Bit Form