CVE-2022-4774 Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files, including PHP, to achieve remote code execution on WordPress sites using the Bit Form plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4774?
CVE-2022-4774 is a critical vulnerability in Unknown Bit Form, published on 15 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.
Which versions are affected by CVE-2022-4774?
It affects 1 product.
Products include Bitapps Bit Form.
How do I fix CVE-2022-4774?
No fix has been published for CVE-2022-4774 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4774 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4774 exists.
Other vulnerabilities in Unknown Bit Form
- CVE-2024-43249 WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerability
- CVE-2024-43248 WordPress Bit Form Pro plugin <= 2.6.4 - Unauthenticated Arbitrary File Deletion vulnerability
- CVE-2024-43250 WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Plugin Settings Change vulnerability
- CVE-2024-43251 WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Sensitive Data Exposure vulnerability
- CVE-2024-13451 Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure
Sources
Also known as GHSA-5267-x3g9-g6x7.