Bit Form WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Bit Form builder plugin for WordPress, affecting all versions through 2.20.3. The issue arises from inadequate file type validation, enabling unauthenticated attackers to upload arbitrary files to the server. This vulnerability could potentially lead to remote code execution, particularly if the uploaded file is executable. Exploitation requires the PRO version of the plugin to be installed and activated, along with a published form that includes an advanced file upload element.

Impact

The vulnerability allows for unauthenticated arbitrary file uploads, which could be exploited to execute malicious files on the server, leading to remote code execution.

Reproduction

To reproduce this vulnerability, upload a file through a form that includes an advanced file upload element. The file type will not be properly validated, allowing for the upload of potentially malicious files.

Remediation

Users are advised to update the Bit Form WordPress plugin to version 2.20.4 or later.