CVE-2024-43249: Bit Apps Bit Form Pro RCE Vulnerability

CVE-2024-43249 Overview

CVE-2024-43249 is an unrestricted file upload vulnerability in the Bit Apps Bit Form Pro plugin for WordPress. The flaw affects all versions up to and including 2.6.4. Authenticated attackers with low-privilege access can upload files of dangerous types, leading to command injection on the underlying server. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload malicious files and execute arbitrary commands, resulting in full compromise of the WordPress site and hosting environment.

Affected Products

Bit Apps Bit Form Pro (WordPress plugin) versions through 2.6.4
WordPress sites with the Bit Form Pro plugin installed and activated
Environments allowing low-privilege authenticated users access to form submission endpoints

Discovery Timeline

2024-08-19 - CVE-2024-43249 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43249

Vulnerability Analysis

The Bit Form Pro plugin fails to properly validate file types accepted through its form upload functionality. An authenticated user can bypass file type restrictions and upload executable content such as PHP scripts to the web server. Once uploaded, these files are reachable through the web root and execute in the context of the WordPress process.

This behavior leads to command injection because the uploaded payload runs server-side code chosen by the attacker. The result is arbitrary command execution against the confidentiality, integrity, and availability of the host system.

Root Cause

The root cause is missing or insufficient file type validation on the plugin's upload handler. The plugin does not enforce a strict allowlist of MIME types or file extensions, nor does it verify file content against declared type. Attackers manipulate the upload request to submit files with executable extensions that the server subsequently processes as code.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session with low privileges. An attacker submits a crafted upload request to a vulnerable Bit Form Pro endpoint. The request contains a malicious PHP file disguised or renamed to bypass client-side and server-side checks. After the upload succeeds, the attacker navigates to the uploaded file's URL to trigger execution and issue commands.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-43249

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar located within Bit Form Pro upload directories under wp-content/uploads/
Web server access logs showing POST requests to Bit Form Pro upload endpoints followed by GET requests to newly created files
Outbound network connections initiated by the PHP worker process to unfamiliar hosts
New WordPress administrator accounts or modified theme and plugin files following form submissions

Detection Strategies

Audit the WordPress uploads directory for files whose extensions do not match expected media types
Compare file hashes of installed plugin files against known-good releases to identify tampering
Correlate authenticated form submissions with subsequent script execution requests in web server logs

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and wp-content/uploads/ directories
Alert on the creation of any file with a script extension inside directories intended for user uploads
Monitor PHP process execution for spawning of shell interpreters such as sh, bash, or cmd.exe
Log and review all Bit Form Pro API requests, particularly those containing multipart file payloads

How to Mitigate CVE-2024-43249

Immediate Actions Required

Update Bit Form Pro to a version later than 2.6.4 as soon as the vendor releases a fixed build
Restrict low-privilege user registration and review existing accounts that could submit form uploads
Inspect the wp-content/uploads/ directory for unauthorized script files and remove any that are found
If a patched version is not available, deactivate and remove the Bit Form Pro plugin

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and vendor advisory information. Site administrators should apply the latest available update from Bit Apps that addresses the file upload validation defect.

Workarounds

Configure the web server to disallow PHP execution within the wp-content/uploads/ directory using directives such as php_flag engine off in Apache or a location block in nginx
Deploy a web application firewall rule to block uploads containing PHP or other script content to Bit Form Pro endpoints
Reduce the number of users granted authenticated access until the plugin is patched or removed

bash

# Example nginx configuration to block script execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 403;
}