Introduction
One vulnerable WordPress plugin can give attackers direct access to thousands of business websites. In August 2025, a critical flaw in the Bit Form builder plugin for WordPress (CVE-2025-6679) exposed a large number of sites to remote code execution by unauthenticated attackers. This post summarizes the technical details, affected versions, and vendor security history for security professionals assessing their exposure.
Bit Form is a WordPress form builder plugin from CRM Perks, with free and PRO versions and over 10,000 active installations. It is popular for its advanced form-building features, including file uploads and integrations with other WordPress tools. Because it is installed so widely, a vulnerability in Bit Form can affect a large share of WordPress sites at once.
Technical Information
CVE-2025-6679 is a critical arbitrary file upload vulnerability in the Bit Form builder plugin for WordPress, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). It affects all versions up to and including 2.20.4.
The flaw is in the advanced file upload feature that the PRO version of Bit Form provides. When a WordPress site has both the free and PRO versions installed and activated, and has published a form containing an advanced file upload element, the plugin does not enforce proper file type validation. Unauthenticated attackers can then upload arbitrary files, including executable PHP scripts, to the server.
An attack runs like this:
- The attacker locates a WordPress site running Bit Form (<= 2.20.4) with both free and PRO versions active.
- The attacker finds a published form with an advanced file upload element.
- Through that form, the attacker submits a crafted request containing a malicious file, such as a PHP web shell.
- Because server-side validation is missing or insufficient, the plugin accepts the file and writes it to the server (commonly in wp-content/uploads).
- The attacker opens the uploaded file directly over the web, which triggers remote code execution with the privileges of the web server process.
The root cause is that the file upload handler for advanced file uploads lacks adequate server-side validation of file type and content. Earlier versions of this plugin family had the same problem, as several prior CVEs show. No public code snippets are available for this specific CVE, but related advisories indicate that the vulnerable logic sits in the PRO version's file upload processing path for advanced elements.
Affected Systems and Versions
- Product: Bit Form builder plugin for WordPress
- Affected versions: All versions up to and including 2.20.4
- Vulnerable configuration: Both free and PRO versions installed and activated, with at least one published form containing an advanced file upload element
Vendor Security History
CRM Perks, the developer of Bit Form, has had file upload vulnerabilities in this and related plugins again and again:
- CVE-2024-6123: Arbitrary file upload in Bit Form up to 2.13.3 (iconUpload function)
- CVE-2024-7782: Arbitrary file deletion in Bit Form (could lead to RCE)
- Arbitrary file upload in Bit Form <= 1.8.1 (2024-01-22)
- Arbitrary file upload in Bit Form < 1.9 (2023-05-15)
- Authenticated file upload in Bit Form PRO <= 2.6.4
The vendor typically releases patches within a week of public disclosure, but has not consistently fixed the underlying architectural flaws. Security advisories and changelogs often mention file upload security improvements, yet similar vulnerabilities have reappeared in later versions.
References
- NVD entry for CVE-2025-6679
- VulDB entry
- WordPress plugin page
- Wordfence advisory
- GitHub advisory for earlier Bit Form file upload issue
- Wordfence advisory for Bit Form <= 1.8.1
- Wordfence advisory for Bit Form 2.12.2
- Wordfence advisory for Bit Form arbitrary file deletion
- Wordfence advisory for Bit Form PRO <= 2.6.4
- CWE-434: Unrestricted Upload of File with Dangerous Type
