CVE-2025-6679: Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6679?
The severity of CVE-2025-6679 is considered high due to the risk of arbitrary file uploads.
How do I fix CVE-2025-6679?
To fix CVE-2025-6679, update the Bit Form Contact Form plugin to version 2.20.5 or later.
Who is affected by CVE-2025-6679?
CVE-2025-6679 affects all versions of the Bit Form Contact Form plugin up to and including 2.20.4.
What kind of files can be uploaded due to CVE-2025-6679?
Due to CVE-2025-6679, unauthenticated attackers can upload any arbitrary files, potentially leading to serious security breaches.
Is authentication required to exploit CVE-2025-6679?
No, CVE-2025-6679 can be exploited by unauthenticated attackers, making it a critical security concern.