PT-2024-39668 · WordPress · The Contact Form By Bit Form

Siunam

+1

·

Published

2024-10-11

·

Updated

2024-10-15

·

CVE-2024-9507

CVSS v3.1

4.9

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions The Contact Form by Bit Form plugin for WordPress versions up to, and including, 2.15.2
Description The issue arises from improper input validation within the iconUpload function, allowing authenticated attackers with Administrator-level access and above to read the contents of arbitrary files on the server. This can be achieved by leveraging a PHP filter chain attack, potentially exposing sensitive information.
Recommendations For versions up to, and including, 2.15.2, update to a version that includes a fix for the improper input validation in the iconUpload function. As a temporary workaround, consider restricting access to the iconUpload function to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-9507

Affected Products

The Contact Form By Bit Form