Bit Form Contact Form Payment Forms Multi Step Forms Calculator Custom Form Builder
Monthly
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.
Arbitrary file deletion in the Bit Form WordPress plugin (all versions through 3.1.1) lets low-privileged authenticated users delete any file on the server via an unsanitized path passed to the deleteFiles function. Because a subscriber-level attacker can remove critical files such as wp-config.php, this path traversal escalates into a full site takeover / remote code execution scenario. Reported by Wordfence with a CVSS of 7.1; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.
Arbitrary file deletion in the Bit Form WordPress plugin (all versions through 3.1.1) lets low-privileged authenticated users delete any file on the server via an unsanitized path passed to the deleteFiles function. Because a subscriber-level attacker can remove critical files such as wp-config.php, this path traversal escalates into a full site takeover / remote code execution scenario. Reported by Wordfence with a CVSS of 7.1; no public exploit identified at time of analysis and it is not listed in CISA KEV.