Medium severity5.5NVD Advisory· Published Aug 20, 2024· Updated Jun 17, 2026

CVE-2024-7775

Description

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Filemanagerpro/Contact Form Builder
cpe:2.3:a:bitapps:contact_form_builder:*:*:*:*:*:wordpress:*:*
Range: >=2.0.0,<2.13.10
WordPress/Bit Formllm-fuzzy2 versions
2.0 - 2.13.9+ 1 more
- (no CPE)range: 2.0 - 2.13.9
- (no CPE)
Package: https://wordpress.org/plugins/bit-form
bitpressadmin/Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builderv5
Range: 2.0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/bit-form/tags/2.13.6/includes/Admin/AdminAjax.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/3936d7dc-840e-41fc-8af4-db40c0cff660nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000