What is the CVSS score of CVE-2026-25418?

CVE-2026-25418 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Bit Form are affected by CVE-2026-25418?

A SQL injection vulnerability in Bit Form plugin (versions up to 2.21.10) poses a significant risk to organizations using this WordPress form builder, potentially allowing attackers to extract…

How to fix or mitigate CVE-2026-25418?

Within 24 hours: Identify all instances of Bit Form plugin in your environment and document affected versions. Within 7 days: Implement compensating controls including WAF rules to block SQL injection patterns, disable Bit Form public-facing functionality if non-critical, and restrict plugin access to authenticated users only. Within 30 days: Establish communication with Bitpress for patch status, evaluate plugin alternatives, or plan controlled upgrades once patches are released.

Bit Form CVE-2026-25418

HIGH

SQL Injection (CWE-89)

2026-02-19 audit@patchstack.com

SQLi

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 09:16 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bitpressadmin Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.

AnalysisAI

SQL injection in Bit Form through version 2.21.10 enables authenticated attackers with high privileges to execute arbitrary database queries, potentially exposing sensitive data. The vulnerability requires administrative credentials but has no available patch, leaving affected installations at risk until an update is released.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects bitpressadmin Bit Form bit-form. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bitpressadmin Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.

Affected ProductsAI

Product: bitpressadmin Bit Form bit-form.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.