CVE-2024-7782
Published: 20 August 2024
Summary
CVE-2024-7782 is a high-severity Path Traversal (CWE-22) vulnerability in Bitapps Contact Form Builder. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Contact Form by Bit Form plugin for WordPress, in versions 2.0 through 2.13.4, is vulnerable to arbitrary file deletion because the iconRemove function performs insufficient validation of supplied file paths. The flaw is tracked as CVE-2024-7782, carries a CVSS 3.1 score of 8.7, and is classified under CWE-22 path traversal.
An attacker who has already obtained Administrator privileges can invoke the affected AJAX handler to supply an arbitrary path and delete any file readable by the web server process. Successful deletion of files such as wp-config.php can disable the site or enable follow-on remote code execution.
The supplied references point to the vulnerable code location in the plugin repository and to a Wordfence advisory entry, but contain no explicit statements about patch availability or mitigation steps. The associated EPSS score has remained flat at 0.1011 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48643
Vulnerability details
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in…
more
versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.