CVE-2024-8756 is a sensitive information exposure vulnerability (CWE-200) in the Quform - WordPress Form Builder plugin affecting all versions up to 2.20.0. The issue arises from the 'saveUploadedFile' function, which improperly restricts access to uploaded files, enabling unauthenticated attackers to extract sensitive data such as PII. The vulnerability persists for files uploaded via forms created before version 2.21.0 even after upgrading, requiring manual remediation steps to fully mitigate the risk.

An unauthenticated attacker can access sensitive information contained in files uploaded through vulnerable forms, potentially leading to unauthorized disclosure of Personally Identifiable Information. The vulnerability does not affect the integrity or availability of the system but compromises confidentiality. The risk remains for previously uploaded files after upgrading, increasing exposure if remediation steps are not followed.

Upgrade the Quform plugin to version 2.21.0 or later to address the vulnerability in new forms. For full remediation, site administrators must download and securely store any previously uploaded files, delete all previously existing files and forms created before the upgrade, and then recreate the forms after upgrading. This manual cleanup is necessary because files uploaded via older forms remain vulnerable despite the plugin update. No automated patch or fix is available for previously uploaded files.