EUVD-2026-58588
GHSA-8r5c-h8x2-g6v4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-accessible admin AJAX endpoint requires valid administrator credentials (PR:H/AV:N/AC:L); SQL injection yields full database read and write access (C:H/I:H) with no availability disruption described (A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Bit Form - Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared data[queryCondition] parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress administrator-level account (or higher privilege), confirmed by the CVSS PR:H metric - lower-privileged roles such as Editor, Author, Contributor, or Subscriber cannot trigger this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) accurately characterizes the constrained but high-impact nature of this flaw: network accessibility and low attack complexity are offset by the hard requirement for administrator-level WordPress credentials (PR:H), substantially narrowing the exploitable population to insiders, credential-theft scenarios, or compromised admin accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Bit Form plugin to a version beyond 3.2.0 as the primary remediation; the specific patched release version was not confirmed in the available intelligence data and must be verified against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/402f32fa-466b-4d9e-948f-3b7dc4507105?source=cve or the official WordPress plugin changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today