Bit Form EUVD-2025-210577

Exploitation requires the attacker to hold a WordPress administrator role with access to the Bit Form plugin's conversational-form display settings. On standard single-site WordPress installs, administrators inherently have the unfiltered_html capability, reducing the practical impact of this bypass - the vulnerability is most impactful on WordPress multisite, where administrator accounts are explicitly denied unfiltered_html. After the payload is stored, a second condition must be met: at least one site visitor must load a page rendering the poisoned form (UI:R). The limiting factors are the high-privilege write requirement (PR:H), the passive victim dependency (UI:R), and the WordPress multisite context making this most relevant. The injection point is specifically the conversational-form display settings field, not the broader plugin or WordPress admin interface.

The CVSS 4.8 Medium score and PR:H vector correctly characterize this as a constrained threat: exploitation requires prior compromise or possession of a WordPress administrator account, then a second victim (site visitor) must actively load the poisoned form page (UI:R). EPSS at 0.16% in the 6th percentile independently confirms that observed exploitation probability is very low. SSVC classifies exploitation as 'poc' (not active), not automatable, and technical impact as partial - consistent with the limited C:L/I:L CVSS impact metrics. No CISA KEV listing. Despite the publicly available POC from WPScan, the combination of high-privilege write requirement and passive visitor trigger significantly limits realistic attacker opportunity. The primary concern is targeted abuse within a compromised or malicious-insider WordPress admin scenario on multisite deployments. Risk is low for single-site installs where administrators already hold unfiltered_html.

An attacker with administrator credentials on a WordPress multisite installation (where the unfiltered_html cap is absent) navigates to the Bit Form conversational-form display settings and inserts a JavaScript payload into the unsanitized field. The payload is saved to the database. When any subsequent visitor loads a page containing the affected form, the malicious script executes silently in their browser, enabling session cookie theft, credential harvesting via overlay forms, or redirection to attacker-controlled infrastructure. A public proof-of-concept is available via WPScan, lowering the skill barrier for exploitation once admin access is obtained.