CVE-2024-6123: 
WordPress vulnerability analysis and mitigation

The Bit Form plugin for WordPress (versions up to 2.13.3) contains a vulnerability related to arbitrary file uploads due to missing file type validation in the 'iconUpload' function. This vulnerability was assigned CVE-2024-6123 and was discovered in July 2024 (NVD).

The vulnerability stems from insufficient file type validation in the 'iconUpload' function within the WordPress Bit Form plugin. The issue has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (Wordfence).

The vulnerability allows authenticated attackers with administrator-level permissions to upload arbitrary files to the affected site's server, potentially enabling remote code execution (NVD).

The vulnerability requires administrator-level or higher permissions to exploit. While this limits the potential attack surface, it still presents a significant risk if administrator credentials are compromised (NVD).

Users should update their Bit Form plugin to a version newer than 2.13.3 to address this vulnerability. The issue has been patched in subsequent releases (Wordfence).