CVE-2024-12190mediumCWE-862

CVE-2024-12190: falha de média gravidade em bitpressadmin Bit Form – Custom Contact Form…

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.5%
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
bitpressadmin · Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder
CVEs relacionadas — bitpressadmin Bit Form – Custom Contact Form…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-6123HIGHBit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File UploadEPSS 1.0%CVE-2025-6679CRITICALContact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2024-9507MEDIUMContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File ReadEPSS 0.5%CVE-2024-1640MEDIUMContact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission AlterationEPSS 0.5%CVE-2025-14901MEDIUMBit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow ReplayEPSS 0.4%CVE-2024-13450LOWContact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request ForgeryEPSS 0.4%