Critical severity9.8NVD Advisory· Published May 15, 2023· Updated Jun 17, 2026

CVE-2022-4774

Description

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Filemanagerpro/Bit Form
cpe:2.3:a:bitapps:bit_form:*:*:*:*:*:wordpress:*:*
Range: <1.9
Bit Form/Bit Formdescription
WordPress/Bit Formllm-fuzzy
Range: <1.9
Package: https://wordpress.org/plugins/bit-form

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5envdExploit

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000