Medium severity5.3NVD Advisory· Published Jul 2, 2025· Updated Jun 17, 2026

CVE-2024-13451

Description

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Filemanagerpro/Bit Form
cpe:2.3:a:bitapps:bit_form:*:*:*:*:free:wordpress:*:*
Range: <2.17.6
WordPress/Bit Formllm-fuzzy2 versions
<=2.17.4+ 1 more
- (no CPE)range: <=2.17.4
- (no CPE)
Package: https://wordpress.org/plugins/bit-form
bitpressadmin/Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builderv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3233293/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/b23bdba3-8947-47e4-b208-55e42865ab72nvdThird Party Advisory
plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Util/FileHandler.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000