The Contact Form by Bit Form plugin for WordPress suffers from an improper input validation vulnerability (CWE-20) in its iconUpload function. This flaw enables authenticated users with Administrator privileges to exploit a PHP filter chain attack to read arbitrary files on the server. The vulnerability affects all versions up to and including 2.15.2. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact. No patch or official remediation guidance is currently available.

An attacker with Administrator-level access can read arbitrary files on the server, potentially exposing sensitive information such as configuration files, credentials, or other protected data. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires high privileges (Administrator) and no user interaction, making it a moderate risk in environments where such privileges are granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to file access within the plugin. Avoid using affected versions of the plugin if possible or consider disabling the iconUpload functionality if feasible.