CVE-2024-7775: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7775?
CVE-2024-7775 has a high severity rating due to its potential for arbitrary JavaScript file uploads.
How do I fix CVE-2024-7775?
To fix CVE-2024-7775, update the Contact Form Builder plugin to version 2.13.10 or later.
What versions of the Contact Form Builder are affected by CVE-2024-7775?
CVE-2024-7775 affects versions 2.0 to 2.13.9 of the Contact Form Builder plugin.
What kind of vulnerability is CVE-2024-7775?
CVE-2024-7775 is a vulnerability that allows for arbitrary JavaScript file uploads due to insufficient input validation.
Is user data at risk due to CVE-2024-7775?
Yes, CVE-2024-7775 poses a risk to user data as it can enable unauthorized script execution.