CVE-2024-12190

MEDIUM 4.3

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.

CWE	CWE-862
Vendor	bitpressadmin
Product	bit form – custom contact form, multi step, conversational form & payment form builder
Published	Dec 25, 2024
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builder

Be the first to know when new medium vulnerabilities affecting bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

bitpressadmin / Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder

0 ≤ 2.17.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9dab37-4118-4e13-857c-9aa072d25edf?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3204875/bit-form/trunk/includes/Frontend/FormEntryView.php plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3209668/bit-form/trunk/includes/Frontend/FormEntryView.php

Credits

Akbar Kustirama