WordPress Bit Form Plugin CVE-2024-9507 Arbitrary File Read via Improper Input Validation

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: - Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read 2. Vulnerability Severity: - CVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS: 4.9 (Medium) 3. Vulnerability Description: - The Multi Step Form, Calculation Contact Form, Payment Contact Form, and Custom Contact Form builder plugins in the Contact Form by Bit Form plugin, in versions <= 2.15.2, have an improper input validation vulnerability. This allows an authenticated attacker with administrator privileges to exploit a PHP filter chain attack and read arbitrary files via the iconUpload function, potentially accessing sensitive information on the server. 4. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 5. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 6. Affected Versions: - <= 2.15.2 7. Fixed Version: - 2.15.3 8. Reference Links: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 9. Vulnerability Type: - Improper Input Validation 10. Vulnerability ID: - CVE-2024-9507 11. Vulnerability Score: - 4.9 (Medium) 12. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 13. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 14. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 15. Vulnerability Type: - Improper Input Validation 16. Vulnerability ID: - CVE-2024-9507 17. Vulnerability Score: - 4.9 (Medium) 18. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 19. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 20. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 21. Vulnerability Type: - Improper Input Validation 22. Vulnerability ID: - CVE-2024-9507 23. Vulnerability Score: - 4.9 (Medium) 24. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 25. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 26. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 27. Vulnerability Type: - Improper Input Validation 28. Vulnerability ID: - CVE-2024-9507 29. Vulnerability Score: - 4.9 (Medium) 30. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 31. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 32. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 33. Vulnerability Type: - Improper Input Validation 34. Vulnerability ID: - CVE-2024-9507 35. Vulnerability Score: - 4.9 (Medium) 36. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 37. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 38. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 39. Vulnerability Type: - Improper Input Validation 40. Vulnerability ID: - CVE-2024-9507 41. Vulnerability Score: - 4.9 (Medium) 42. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 43. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 44. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 45. Vulnerability Type: - Improper Input Validation 46. Vulnerability ID: - CVE-2024-9507 47. Vulnerability Score: - 4.9 (Medium) 48. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 49. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 50. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 51. Vulnerability Type: - Improper Input Validation 52. Vulnerability ID: - CVE-2024-9507 53. Vulnerability Score: - 4.9 (Medium) 54. Vulnerability Impact: - Affected Software Type: Plugin - Plugin Name: bit-form - Plugin Version: <= 2.15.2 - Plugin Status: Fixed 55. Vulnerability Publication Date: - Publicly disclosed on October 10, 2024 56. Vulnerability Update Status: - Fixed. It is recommended to update to version 2.15.3 or higher. 57. Vulnerability Type: - Improper Input Validation 58. Vulnerability ID: - CVE-2024-9507 59. Vulnerability Score: - 4.9 (Medium) 60. Vulnerability Impact: - Affected Software Type: Plugin - Plu

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Bit Form Plugin CVE-2024-9507 Arbitrary File Read via Improper Input Validation

More from this source