Bit Form CVE-2026-16810

Exploitation requires a valid WordPress administrator-level account (or higher privilege), confirmed by the CVSS PR:H metric - lower-privileged roles such as Editor, Author, Contributor, or Subscriber cannot trigger this flaw. The attacker must direct a crafted request to the Bit Form plugin's AJAX handling layer with a malicious SQL fragment embedded in the data[queryCondition] parameter; no additional non-default plugin configuration, special feature flag, or unusual deployment mode is described as necessary beyond the plugin being installed and active on a WordPress instance running version 3.2.0 or earlier. What limits exploitation: the hard administrator credential prerequisite is the primary barrier, and any site enforcing MFA on admin accounts or maintaining a minimal admin user list substantially reduces realistic risk. The attack vector is network-accessible (AV:N) and low complexity (AC:L) once credentials are in hand, meaning no brute-force timing or race condition is required.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) accurately characterizes the constrained but high-impact nature of this flaw: network accessibility and low attack complexity are offset by the hard requirement for administrator-level WordPress credentials (PR:H), substantially narrowing the exploitable population to insiders, credential-theft scenarios, or compromised admin accounts. EPSS data was not included in the intelligence package and remains unknown, preventing probabilistic exploitation comparison. Neither a public proof-of-concept nor a CISA KEV listing exists at time of analysis, indicating this is a credible but not actively-weaponized finding. The C:H/I:H impact metrics are meaningful - form submission data, user PII, payment references, and other sensitive records stored by the plugin are fully readable and writable upon exploitation - and even a mid-sized municipal IT team in tczew running a WordPress-based public services portal with this plugin installed should treat this as a near-term remediation priority rather than a deferred item. There are no internal contradictions between the CVSS vector and the description: both confirm the attack is network-reachable but gated behind administrator authentication.

An attacker who has acquired or compromised a valid WordPress administrator account on a site running Bit Form 3.2.0 or earlier crafts an AJAX request to one of the plugin's admin endpoints - such as AdminAjax.php - embedding a SQL injection payload in the data[queryCondition] parameter. Because the parameter is appended to an existing SQL query without proper escaping or prepared statement binding across multiple code files, the injected SQL executes as part of the query, enabling the attacker to enumerate tables, dump form submission records containing PII or payment references, or modify data. No public proof-of-concept has been identified, but the vulnerability class is well-understood and exploitation requires no specialized tooling beyond standard SQL injection techniques.