CVE-2025-6679: CWE-434 Unrestricted Upload of File with Dangerous Type in bitpressadmin Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
AI Analysis
Technical Summary
CVE-2025-6679 is a critical vulnerability in the Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder WordPress plugin by bitpressadmin. The issue arises from CWE-434: Unrestricted Upload of File with Dangerous Type, where the plugin fails to validate file types during upload. This flaw exists in all versions up to and including 2.20.4. An unauthenticated attacker can exploit this by uploading arbitrary files if the PRO version is active and a form with an advanced file upload element is published, potentially enabling remote code execution on the server hosting the WordPress site.
Potential Impact
The vulnerability allows unauthenticated attackers to upload arbitrary files to the server, which can lead to full compromise of the affected WordPress site through remote code execution. The CVSS v3.1 score of 9.8 reflects the high impact on confidentiality, integrity, and availability. However, exploitation requires specific conditions: the PRO version must be installed and activated, and a form with an advanced file upload element must be published.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming official patches promptly. Until a fix is available, consider disabling the PRO version or removing advanced file upload forms to mitigate risk. Avoid exposing the vulnerable plugin on publicly accessible sites without these mitigations.
CVE-2025-6679: CWE-434 Unrestricted Upload of File with Dangerous Type in bitpressadmin Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder
Description
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-6679 is a critical vulnerability in the Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder WordPress plugin by bitpressadmin. The issue arises from CWE-434: Unrestricted Upload of File with Dangerous Type, where the plugin fails to validate file types during upload. This flaw exists in all versions up to and including 2.20.4. An unauthenticated attacker can exploit this by uploading arbitrary files if the PRO version is active and a form with an advanced file upload element is published, potentially enabling remote code execution on the server hosting the WordPress site.
Potential Impact
The vulnerability allows unauthenticated attackers to upload arbitrary files to the server, which can lead to full compromise of the affected WordPress site through remote code execution. The CVSS v3.1 score of 9.8 reflects the high impact on confidentiality, integrity, and availability. However, exploitation requires specific conditions: the PRO version must be installed and activated, and a form with an advanced file upload element must be published.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming official patches promptly. Until a fix is available, consider disabling the PRO version or removing advanced file upload forms to mitigate risk. Avoid exposing the vulnerable plugin on publicly accessible sites without these mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-06-25T19:36:25.214Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 689ed815ad5a09ad00637456
Added to database: 8/15/2025, 6:47:49 AM
Last enriched: 4/9/2026, 5:46:18 PM
Last updated: 5/10/2026, 1:33:36 AM
Views: 192
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.