CVE-2024-6123 is a CWE-434 vulnerability in the Bit Form plugin for WordPress by bitpressadmin. The issue arises from a lack of file type validation in the 'iconUpload' function, permitting authenticated users with administrator privileges to upload arbitrary files. This can lead to remote code execution on the affected server. The vulnerability affects all versions up to and including 2.13.3. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with administrator-level access can upload arbitrary files to the server hosting the WordPress site. This may lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability poses a high risk due to the potential for full system compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary administrator privileges to reduce risk.