Bit Flows
Monthly
Unauthenticated local file inclusion in the Bit Flows WordPress plugin through 1.31.0 lets a remote caller make the ImageHelper imageToBase64 node include and execute attacker-chosen server-side .php files, exposing file contents and enabling PHP code execution when an uploadable .php file is reachable. The bar is high: an administrator must already have published a webhook-triggered flow that pipes a webhook body field into the ImageHelper node, and that webhook must still be running with no bearer secret and no IP allowlist - an explicitly supported, documented setup, which is why this is scored AC:H and assessed as a qualified medium-severity issue rather than an emergency. No public exploit has been identified at time of analysis and there is no CISA KEV listing; the vulnerability is rated for this-month handling.
Unauthenticated local file inclusion in the Bit Flows WordPress plugin through 1.31.0 lets a remote caller make the ImageHelper imageToBase64 node include and execute attacker-chosen server-side .php files, exposing file contents and enabling PHP code execution when an uploadable .php file is reachable. The bar is high: an administrator must already have published a webhook-triggered flow that pipes a webhook body field into the ImageHelper node, and that webhook must still be running with no bearer secret and no IP allowlist - an explicitly supported, documented setup, which is why this is scored AC:H and assessed as a qualified medium-severity issue rather than an emergency. No public exploit has been identified at time of analysis and there is no CISA KEV listing; the vulnerability is rated for this-month handling.