Bit Integrations EUVD-2026-37985

Exploitation requires that at least one active Bit Integrations configuration exists on the WordPress site with a form field mapped to one of the following specific WooCommerce fields: product image, product gallery, or downloadable files; OR a Google Contacts attachment field. The description explicitly states this is a default use case for these integrations, meaning the condition is met on a significant portion of production deployments rather than requiring a deliberately unusual setup. The CVSS vector PR:N confirms no authentication is required. Exploitation is limited to sites where these specific integration types are configured and active - sites using Bit Integrations solely for non-attachment integrations (e.g., email automation without file fields, spreadsheet sync without attachment columns) are not exploitable via this vector.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N yields a base score of 6.5, which accurately represents the network reachability and lack of authentication required, but may understate real-world risk in cloud-hosted WordPress deployments where SSRF can reach instance metadata services (e.g., AWS IMDSv1) and yield credential material. No EPSS score or KEV listing was provided in the input data, so exploitation probability cannot be quantified probabilistically. No public exploit or proof-of-concept code has been identified at time of analysis. The critical differentiator from a generic medium-severity SSRF is that the exploitation condition - having a form integration mapped to WooCommerce product images, galleries, downloadable files, or Google Contacts attachments - is explicitly described as a default use case, meaning a large proportion of real-world deployments are vulnerable by design. The scope metric S:U in the CVSS vector slightly undersells the risk, as SSRF by definition reaches systems outside the vulnerable component, though the measured confidentiality and integrity impact at C:L/I:L reflects partial rather than full compromise of those internal systems.

An unauthenticated attacker identifies a WordPress site running Bit Integrations with an active WooCommerce or Google Contacts integration that maps an attachment field. The attacker submits a crafted form payload to the upload_attachment endpoint supplying a URL pointing to the AWS instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/), causing the web server to fetch and return IAM credential material. No public exploit code has been identified at time of analysis, but the attack requires no authentication and targets a configuration that is described as a default integration use case.