PT-2025-33446 · WordPress · Bit Form Builder

Phat Rio · Published 2025-08-15 · Updated 2025-08-20 · CVE-2025-6679

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bit Form builder plugin for WordPress versions up to and including 2.20.4

Description: The Bit Form builder plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. Exploitation requires the PRO version to be installed and activated, as well as a published form with an advanced file upload element.

Recommendations: Update the Bit Form builder plugin to a version newer than 2.20.4.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-6679

Affected Products

Bit Form Builder

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6679 · Security Note
• https://wordpress.org/plugins/bit-form · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3343461%40bit-form%2Ftrunk&old=3336733%40bit-form%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/132398 · Telegram Post
• https://twitter.com/CVEnew/status/1956289026669076624 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1956348298295472490 · Twitter Post
• https://twitter.com/cracbot/status/1958121902553121049 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6e2e294f-904b-4674-8baf-d3a9a260d634?source=cve · Note
• https://t.me/CVEtracker/30092 · Telegram Post