CVE-2024-13451: Bit Form Information Disclosure Flaw

CVE-2024-13451 Overview

CVE-2024-13451 affects the Contact Form by Bit Form plugin for WordPress, a builder used for multi-step, calculation, payment, and custom contact forms. The plugin exposes uploaded files to unauthenticated attackers through two compounding flaws: missing directory listing prevention and predictable file names. All versions up to and including 2.17.4 are affected. Vendor bitapps released a partial fix in version 2.17.5. The weakness is tracked as Sensitive Information Exposure [CWE-200] and is reachable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can enumerate and retrieve files submitted through Bit Form contact forms, exposing personally identifiable information, payment artifacts, and other sensitive uploads.

Affected Products

Bitapps Bit Form (free, WordPress) versions <= 2.17.4
The Contact Form by Bit Form: Multi Step Form
Calculation, Payment, and Custom Contact Form builder modules

Discovery Timeline

2025-07-02 - CVE-2024-13451 published to the National Vulnerability Database
2025-07-10 - Last updated in NVD database

Technical Details for CVE-2024-13451

Vulnerability Analysis

The Bit Form plugin accepts file uploads from form submissions and stores them on the web server inside a publicly reachable directory. The plugin does not place an index.php or .htaccess restriction in the upload path to suppress directory indexing. When the web server has autoindex enabled, an unauthenticated visitor can list every uploaded file. The plugin also writes files using predictable names derived from the original submission rather than a random token, so attackers can guess filenames even when listing is disabled. The combination turns any form upload into an information disclosure primitive. The vulnerability is unauthenticated, network reachable, and impacts confidentiality only — integrity and availability are not affected.

Root Cause

The file storage logic in includes/Core/Util/FileHandler.php writes user-submitted files to a static upload directory without two controls: a directory index guard file and a randomized filename component. Both omissions are required to reach the disclosure condition, which is why version 2.17.5 is described as a partial fix in the vendor changeset.

Attack Vector

An unauthenticated attacker browses to the plugin's upload directory on a target WordPress site. If autoindex is enabled, the attacker enumerates the directory and downloads each uploaded file directly. If autoindex is disabled, the attacker constructs predictable filenames from known form field patterns and requests them through the web server. No credentials, tokens, or user interaction are required.

No verified public exploit code is available for CVE-2024-13451. See the Wordfence Vulnerability Report and the WordPress FileHandler Util source for technical context.

Detection Methods for CVE-2024-13451

Indicators of Compromise

Web access log entries showing unauthenticated GET requests to the Bit Form upload directory under wp-content/uploads/
Repeated 200 responses for directory paths with no referrer and varied user agents
Sequential or pattern-based requests targeting predictable filenames generated by Bit Form

Detection Strategies

Inspect access.log for requests to Bit Form upload paths that originate outside expected form submission flows.
Detect directory listing responses by alerting on HTML responses containing Index of / from any wp-content/uploads/ subdirectory.
Hunt for high-volume file retrieval from a single source IP against WordPress sites running the Bit Form plugin.

Monitoring Recommendations

Inventory WordPress sites and identify any running Bit Form <= 2.17.4.
Forward web server access logs to a centralized analytics platform and alert on unauthenticated downloads from form upload directories.
Track outbound data volumes from public WordPress hosts for anomalies consistent with bulk file exfiltration.

How to Mitigate CVE-2024-13451

Immediate Actions Required

Update the Bit Form plugin to version 2.17.5 or later on every WordPress instance.
Audit the Bit Form upload directory for files that should not be world readable and rotate or remove sensitive content.
Notify users whose submissions may have been exposed if logs indicate unauthorized access.

Patch Information

The vendor bitapps issued a partial patch in version 2.17.5, tracked in WordPress Changeset 3233293. Because the fix is described as partial, administrators should also apply the workarounds below and monitor the plugin's changelog for further updates.

Workarounds

Disable directory indexing at the web server level by adding Options -Indexes in Apache or autoindex off; in NGINX for the WordPress document root.
Place an empty index.php or restrictive .htaccess file in the Bit Form upload directory to block enumeration.
Move form upload storage outside the web root or restrict access with authentication where the form workflow permits.
Temporarily deactivate the Bit Form plugin on sites that cannot be patched immediately.

bash

# Apache: block directory listing in the WordPress uploads path
cat <<'EOF' > /var/www/html/wp-content/uploads/.htaccess
Options -Indexes
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>
EOF

# NGINX equivalent inside the server block
# location ^~ /wp-content/uploads/ {
#     autoindex off;
# }