What’s Vulnerable › Vulnerabilities

CVE-2022-4774: Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-15 · updated 2026-06-17

Description

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

Affected products

• Bit Form: before 1.9 — fixed in 1.9

How to fix

Upgrade to a fixed version: Bit Form 1.9. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e
• https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e

Get alerted when CVE-2022-4774 or the next vulnerability affects your stack