The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| bitapps | contact_form_builder | 2.0 – ≤ 2.13.4 | |
| bitpressadmin | Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder | 2.0 – ≤ 2.13.4 |
Zwei kostenlose Werkzeuge, eine Abwehr: Der Sensor erfasst, wer Ihren Server abtastet; Shield stoppt bekannte Angreifer, bevor sie Ihre Website erreichen.
Einmal installiert, steigt Ihr tägliches API-Kontingent auf 30.000 Abfragen — ohne Antrag.
