CVE-2022-4774

Deeper analysis

The Bit Form WordPress plugin before version 1.9 contains an unrestricted file upload vulnerability. The component fails to validate file types submitted through its file upload form field, permitting arbitrary extensions such as PHP or HTML to be stored on the server and subsequently executed.

Unauthenticated attackers can exploit the flaw over the network by submitting malicious files via the form. Successful exploitation grants remote code execution with the ability to read, modify, or delete data and fully compromise the affected WordPress site, consistent with the CVSS 9.8 rating that reflects no required authentication or user interaction.

The referenced WPScan advisory identifies the issue in versions prior to 1.9 and indicates that updating the plugin to version 1.9 or later removes the missing file-type validation. No other mitigation details such as workarounds are provided in the available references.

EPSS scores reached a peak of 0.0811 before settling at the current value of 0.0648, indicating modest post-disclosure interest without evidence of widespread exploitation.