CVE-2024-13451: 
WordPress vulnerability analysis and mitigation

CVE-2024-13451 is a Sensitive Information Exposure vulnerability in the Contact Form by Bit Form WordPress plugin (vendor: bitapps), affecting all versions up to and including 2.17.4. The flaw arises from insufficient directory listing prevention and lack of randomization of uploaded file names, enabling unauthenticated attackers to access files submitted through forms. It was published on July 2, 2025, with a partial patch released in version 2.17.5 and a full fix recommended in version 2.17.6. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per NVD (Feedly, Wordfence).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin stores user-uploaded files in a predictable directory path without randomizing file names, and fails to prevent web server directory listing on the upload folder. This allows an unauthenticated remote attacker to enumerate the upload directory and directly retrieve files submitted via contact forms. The vulnerable code path is located in includes/Core/Util/FileHandler.php (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to access and exfiltrate files uploaded by form submitters, which may include personally identifiable information (PII), business documents, or other sensitive user data. The confidentiality impact is rated High, with no integrity or availability impact. Depending on the nature of files collected by the form (e.g., ID documents, contracts, medical records), exposure could result in significant privacy violations or regulatory compliance issues (Feedly, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.027%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Bit Form plugin (versions ≤ 2.17.4) using tools like WPScan, Shodan, or by checking /wp-content/plugins/bit-form/ for plugin presence.
2. Locate upload directory: Navigate to the plugin's default file upload path (typically under /wp-content/uploads/bitform/ or a similar predictable path) to check if directory listing is enabled.
3. Enumerate uploaded files: If directory listing is enabled, browse the directory index to view all uploaded file names. Because file names are not randomized, files may also be guessable based on submission timestamps or sequential patterns.
4. Download sensitive files: Directly request individual files via HTTP GET to retrieve documents, images, or other data submitted by form users (Wordfence, WordPress Trac).

• Network: Unusual HTTP GET requests to /wp-content/uploads/bitform/ or similar plugin upload directories, especially directory listing requests (returning HTML with file indexes) from unknown or automated IP addresses.
• Logs: Web server access logs showing repeated enumeration of the upload directory or sequential file download patterns from a single IP; requests returning HTTP 200 for files in the Bit Form upload path without a corresponding form submission referrer.
• File System: Unexpected access timestamps on files within the Bit Form upload directory that do not correspond to legitimate form submissions.

The vendor released a partial patch in version 2.17.5 and a full resolution is available in version 2.17.6; administrators should upgrade to 2.17.6 or later immediately (WordPress Trac, Wordfence). As interim workarounds, configure the web server (Apache/Nginx) to disable directory listing for the plugin's upload folder, and consider adding an .htaccess rule to restrict direct file access. Implementing random file name generation for uploads and regularly auditing the upload directory for unexpected files are also recommended best practices.