Arbitrary File Read in Bit Form WordPress Plugin

Executive Summary

This vulnerability affects the Bit Form WordPress plugin before version 3.1.0. It allows unauthenticated attackers to read arbitrary server files through a path traversal attack. The issue occurs because the plugin does not properly restrict file paths when reading uploaded files and attaching them to notification emails.

Useful 0 Not Useful 0

Detection Guidance

Check if the Bit Form WordPress plugin version is below 3.1.0. Look for forms with file-upload fields and mail notifications configured to attach uploaded files. Test by submitting a form with a traversal path like ../../../../../../wp-config.php to see if it returns file contents.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to read sensitive files like the WordPress configuration file, which may contain database credentials and authentication keys. The attack requires a form with a file-upload field and a mail notification configured to attach the uploaded file and send it to an attacker-controlled email address.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive server files such as WordPress configuration files containing database credentials and authentication keys. Unauthorized access to such files may result in data breaches, violating confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Bit Form plugin to version 3.1.0 or later immediately. Disable file-upload fields in forms if not required. Review and restrict mail notification settings to prevent file attachments from being sent externally.

Useful 0 Not Useful 0