What is the CVSS score of CVE-2026-15006?

CVE-2026-15006 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Bit Integrations are affected by CVE-2026-15006?

The Bit Integrations WordPress plugin (all versions through 2.9.0) exposes sensitive server files-including database credentials and API keys-to any unauthenticated internet user through a directory…

How to fix or mitigate CVE-2026-15006?

Within 24 hours, scan all WordPress installations for Bit Integrations plugin versions 2.9.0 and earlier; document affected count and assess current exposure via web server access logs for traversal attempts. Within 7 days, disable the Bit Integrations plugin on all affected systems and implement WAF rules blocking requests to MailController.php and CF7Controller.php endpoints; if plugin functionality is operationally critical, consult vendor on interim workarounds. Within 30 days, maintain subscription to Bit Integrations security advisories; upon vendor patch release, test in staging environment and deploy to all production instances within one week of validation.

Bit Integrations CVE-2026-15006

EUVD-2026-51689 HIGH

Path Traversal (CWE-22)

2026-08-01 Wordfence

GHSA-j262-2rh9-xjv4

WordPress Path Traversal Wordpress Plugin Bit Integrations Form Integration Webhook Spreadsheets Crm Lms Email Automation Bitpressadmin

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated file read with no interaction required; read-only impact justifies I:N and A:N, S:U as no scope change occurs.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 02:45 vuln.today

CVE Published

Aug 01, 2026 - 01:29 cve.org

HIGH 7.5

DescriptionCVE.org

The Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.

Technical ContextAI

The Bit Integrations plugin (CPE: cpe:2.3:a:bitpressadmin:bit_integrations_-_form_integration,_webhook,_spreadsheets,_crm,_lms_&_email_automation:*:*:*:*:*:*:*:*) is a WordPress automation plugin providing form-to-CRM, webhook, spreadsheet, LMS, and email automation workflows. The root cause is CWE-22 (Path Traversal): the processAttachment function in backend/Actions/Mail/MailController.php (lines 59 and 123) and the Contact Form 7 integration layer (backend/Triggers/CF7/CF7Controller.php line 127, Hooks.php line 11) fail to canonicalize or restrict file paths supplied during attachment processing. An attacker can inject directory traversal sequences (e.g., ../../) into the attachment path parameter to escape the intended directory and reach arbitrary locations on the server filesystem. Because the plugin integrates with CF7 form submissions, the traversal may be triggerable through standard form submission endpoints without any authentication.

RemediationAI

The primary fix is to update the Bit Integrations plugin to any version released after 2.9.0 - an upstream code fix has been committed per the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3605525%40bit-integrations&new=3605525%40bit-integrations; however, the exact released fixed version number is not confirmed in the available input data and should be verified in the WordPress plugin repository before updating. As an interim compensating control, administrators who cannot immediately patch should consider disabling the plugin entirely, as no targeted workaround (e.g., disabling only the attachment processing feature) is configurable without code modification. Blocking direct access to the plugin's AJAX endpoints via WAF rules or by restricting access to wp-admin and wp-ajax.php can reduce exposure but may break legitimate plugin functionality. The Wordfence advisory at the URL above should be consulted for any updated remediation guidance.