CVE-2024-7777

CVE-2024-7777 is a critical arbitrary file read and deletion vulnerability affecting the Contact Form by Bit Form plugin for WordPress, versions 2.0 to 2.13.9. This flaw, due to insufficient file path validation, allows authenticated attackers with Administrator privileges to read and delete arbitrary files on the server. With a CVSS score of 9.0 (CRITICAL), successful exploitation can lead to remote code execution, particularly if critical files like wp-config.php are deleted, resulting in high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.