Vulnerabilities

TI-2024-12492 CVE-2024-13451 · GHSA-9p36-p37c-r4fp

Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure

LOW 39

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0038 Published 2025-07-02 No fix listed CWE-200

TI-2024-28904 CVE-2024-43251 · GHSA-f4h5-j74p-qq45

WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Sensitive Data Exposure vulnerability

LOW 29

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00418 Published 2024-08-26 No fix listed CWE-200

TI-2024-28903 CVE-2024-43250 · GHSA-qr5p-m4c8-89vq

WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Plugin Settings Change vulnerability

LOW 31

Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00285 Published 2024-08-19 No fix listed CWE-863

TI-2024-28902 CVE-2024-43249 · GHSA-mgfj-pw53-g28v

WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerability

MEDIUM 45

Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a through 2.6.4.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01049 Published 2024-08-19 No fix listed CWE-434

TI-2024-28901 CVE-2024-43248 · GHSA-jp5m-m368-79vw

WordPress Bit Form Pro plugin <= 2.6.4 - Unauthenticated Arbitrary File Deletion vulnerability

MEDIUM 46

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0059 Published 2024-08-19 No fix listed CWE-22

TI-2022-04370 CVE-2022-4774 · GHSA-5267-x3g9-g6x7

Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

HIGH 76

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01785 Published 2023-05-15 Fixed in 1.9