Bit Integrations Form Integration Webhook Spreadsheets Crm Lms Email Automation
Monthly
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.
Server-Side Request Forgery in the Bit Integrations WordPress plugin (all versions through 2.8.7) allows unauthenticated attackers to force the web server to issue arbitrary HTTP requests to internal or external locations via the upload_attachment function. Exploitation enables querying and modifying data from internal services reachable by the web server, including metadata services in cloud environments, internal APIs, or private network endpoints. No public exploit is identified at time of analysis, but the attack requires only a default integration configuration, substantially lowering the practical barrier to exploitation.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.
Server-Side Request Forgery in the Bit Integrations WordPress plugin (all versions through 2.8.7) allows unauthenticated attackers to force the web server to issue arbitrary HTTP requests to internal or external locations via the upload_attachment function. Exploitation enables querying and modifying data from internal services reachable by the web server, including metadata services in cloud environments, internal APIs, or private network endpoints. No public exploit is identified at time of analysis, but the attack requires only a default integration configuration, substantially lowering the practical barrier to exploitation.