EUVD-2026-37985
GHSA-fxr5-h7mw-3fwm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Default integration configuration satisfies exploitation, so AC:L; unauthenticated per CVSS PR:N; partial confidentiality and integrity impact from internal service reach; no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.7 via the upload_attachment. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires a form integration to be configured with a field mapped to a WooCommerce product image, product gallery, downloadable files, or Google Contacts attachment field, which is a default use case for these integrations.
AnalysisAI
Server-Side Request Forgery in the Bit Integrations WordPress plugin (all versions through 2.8.7) allows unauthenticated attackers to force the web server to issue arbitrary HTTP requests to internal or external locations via the upload_attachment function. Exploitation enables querying and modifying data from internal services reachable by the web server, including metadata services in cloud environments, internal APIs, or private network endpoints. No public exploit is identified at time of analysis, but the attack requires only a default integration configuration, substantially lowering the practical barrier to exploitation.
Technical ContextAI
The vulnerability resides in the upload_attachment handler within two distinct RecordApiHelper.php files: one under the WooCommerce integration path (backend/Actions/WooCommerce/RecordApiHelper.php, lines 584 and 631) and one under the Google Contacts integration path (backend/Actions/GoogleContacts/RecordApiHelper.php, lines 139 and 168). CWE-918 (Server-Side Request Forgery) indicates the root cause is unsanitized user-controlled URL input being passed to a server-side HTTP client without restricting the destination to legitimate external services. The affected CPE is cpe:2.3:a:bitpressadmin:bit_integrations_-_form_integration,_webhook,_spreadsheets,_crm,_lms_&_email_automation:*:*:*:*:*:*:*:*. The WordPress plugin mediates integrations between web forms and downstream platforms (WooCommerce, Google Contacts, CRM, LMS, spreadsheets), making attachment URL fetching a functional requirement - and the exploitation surface a structural feature rather than an edge case.
RemediationAI
Upstream fix available (PR/commit via WordPress plugin repository changeset 3571608); a released patched version number is not independently confirmed from available data - administrators should check the WordPress plugin repository for a version newer than 2.8.7 and update immediately. Until a patched release is confirmed and applied, administrators can reduce exposure by reviewing active Bit Integrations configurations and removing or disabling any integrations that map fields to WooCommerce product images, product gallery, downloadable files, or Google Contacts attachment fields - note this may break legitimate integration functionality. At the network layer, configuring an outbound web application firewall or egress filtering rule to block server-initiated requests to RFC-1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254) will limit the blast radius of any SSRF exploitation without requiring plugin changes. On AWS or other cloud platforms, enforcing IMDSv2 (requiring session-oriented token exchange) removes the most severe SSRF-to-credential-theft escalation path. Wordfence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf8d5c2-dbb1-47d5-b858-da6f6e1989f4.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today