Information disclosure in Bitapps Bit Form
CVE-2024-13451
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
Vulnerability class: Information Disclosure
EPSS: 0.003 (24.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Product)
- security@wordfence.com (Patch)
Frequently asked questions
- What is CVE-2024-13451?
- CVE-2024-13451 is a medium-severity vulnerability in Bitapps Bit Form, classified under Information Disclosure. CVSS score: 5.3/10. Published 2025-07-02.
- How severe is CVE-2024-13451?
- Medium severity. CVSS v3 base score is 5.3 out of 10.