CVE-2022-4774 - Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

Back Back to CVE browser

CRITICAL

Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

Published May 15, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.79%

Description

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

Affected products

Vendor n/a Product Bit Form Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Bit Form

unaffected

Version	Status	Constraints
0	affected	<1.9

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52070
Advisory
https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52070		Advisory
https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e		exploitvdb-entrytechnical-description