The Bit Form builder plugin for WordPress allows unauthenticated attackers to upload arbitrary files because it lacks file type validation. If the PRO edition is installed and an advanced file upload element is published, an attacker can place files on the server, potentially enabling remote code execution. The vulnerability is a classic instance of CWE‑434, where insufficient validation of uploaded content creates an attack vector.

WordPress sites running the Bit Form contact‑form plugin (bitpressadmin Bit‑Form) with versions up to and including 2.20.4, especially when the PRO edition is activated and a form featuring the advanced file‑upload field has been published.

The CVSS score of 9.8 classifies it as critical, while the EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs to visit the site and submit the form that contains the upload element; no authentication is required. Successful exploitation would allow the attacker to place arbitrary files on the web‑root, which could be executed by the web server, leading to full remote compromise of the affected host.