Bit Flows EUVD-2026-111610

Exploitation requires that an administrator has already built a webhook-triggered flow that pipes a webhook body field into the plugin's ImageHelper imageToBase64 node, AND that the triggering webhook remains in its default state with no bearer secret enforced and no IP allowlist configured - a documented, legitimate use case. The attacker then controls the body field referenced by the ImageHelper node's mix tag to specify the included path. Limiting factors: the vulnerable flow must pre-exist (reflected as AC:H), so sites without such an ImageHelper-fed webhook are not exposed; escalation to full code execution additionally requires that a .php file can be uploaded and then included, otherwise impact is limited to inclusion/execution of existing server-side .php files. No user interaction or authentication is needed to reach the endpoint itself (UI:N, PR:N).

This is a genuinely qualified medium-severity issue rather than a drop-everything emergency, and the signals are mostly consistent. The CVSS base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) captures the key tension: the webhook is reachable over the network with no authentication (AV:N, PR:N), but AC:H reflects that exploitation depends on a pre-existing condition the attacker does not control - an administrator must have built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, with the webhook left in its default state (no bearer secret, no IP allowlist). The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which aligns with the conditional nature of the flaw. This is NOT in CISA KEV, and no EPSS score was supplied in the input, so widespread or automated exploitation cannot be asserted - the exploitation status is 'no public exploit identified at time of analysis' (the references are the Wordfence advisory and plugin source lines, not working exploit code). The impact ceiling is high where it applies: successful inclusion executes arbitrary PHP, enabling data disclosure, access-control bypass, or code execution when a .php file can be uploaded and included. Net: prioritize patching for sites that actually run such a flow, but the AC:H precondition meaningfully narrows the exposed population versus a raw unauthenticated-RCE reading.

An attacker identifies a WordPress site running Bit Flows where an administrator has configured a webhook-triggered flow feeding a webhook body field into an ImageHelper imageToBase64 node, with the webhook left in its default configuration. The attacker sends a crafted request to that public webhook endpoint supplying, via the ImageHelper mix tag, a path to a .php file on the server (or one they managed to upload), causing the plugin to include and execute it. No working public exploit code was identified at the time of analysis, and the CVSS AC:H reflects that the vulnerable flow must already exist for the attack to succeed.