Bitpressadmin
Monthly
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.
Arbitrary file deletion in the Bit Form WordPress plugin (all versions through 3.1.1) lets low-privileged authenticated users delete any file on the server via an unsanitized path passed to the deleteFiles function. Because a subscriber-level attacker can remove critical files such as wp-config.php, this path traversal escalates into a full site takeover / remote code execution scenario. Reported by Wordfence with a CVSS of 7.1; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated local file inclusion in the Bit Flows WordPress plugin through 1.31.0 lets a remote caller make the ImageHelper imageToBase64 node include and execute attacker-chosen server-side .php files, exposing file contents and enabling PHP code execution when an uploadable .php file is reachable. The bar is high: an administrator must already have published a webhook-triggered flow that pipes a webhook body field into the ImageHelper node, and that webhook must still be running with no bearer secret and no IP allowlist - an explicitly supported, documented setup, which is why this is scored AC:H and assessed as a qualified medium-severity issue rather than an emergency. No public exploit has been identified at time of analysis and there is no CISA KEV listing; the vulnerability is rated for this-month handling.
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.
Server-Side Request Forgery in the Bit Integrations WordPress plugin (all versions through 2.8.7) allows unauthenticated attackers to force the web server to issue arbitrary HTTP requests to internal or external locations via the upload_attachment function. Exploitation enables querying and modifying data from internal services reachable by the web server, including metadata services in cloud environments, internal APIs, or private network endpoints. No public exploit is identified at time of analysis, but the attack requires only a default integration configuration, substantially lowering the practical barrier to exploitation.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.
Arbitrary file deletion in the Bit Form WordPress plugin (all versions through 3.1.1) lets low-privileged authenticated users delete any file on the server via an unsanitized path passed to the deleteFiles function. Because a subscriber-level attacker can remove critical files such as wp-config.php, this path traversal escalates into a full site takeover / remote code execution scenario. Reported by Wordfence with a CVSS of 7.1; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated local file inclusion in the Bit Flows WordPress plugin through 1.31.0 lets a remote caller make the ImageHelper imageToBase64 node include and execute attacker-chosen server-side .php files, exposing file contents and enabling PHP code execution when an uploadable .php file is reachable. The bar is high: an administrator must already have published a webhook-triggered flow that pipes a webhook body field into the ImageHelper node, and that webhook must still be running with no bearer secret and no IP allowlist - an explicitly supported, documented setup, which is why this is scored AC:H and assessed as a qualified medium-severity issue rather than an emergency. No public exploit has been identified at time of analysis and there is no CISA KEV listing; the vulnerability is rated for this-month handling.
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.
Server-Side Request Forgery in the Bit Integrations WordPress plugin (all versions through 2.8.7) allows unauthenticated attackers to force the web server to issue arbitrary HTTP requests to internal or external locations via the upload_attachment function. Exploitation enables querying and modifying data from internal services reachable by the web server, including metadata services in cloud environments, internal APIs, or private network endpoints. No public exploit is identified at time of analysis, but the attack requires only a default integration configuration, substantially lowering the practical barrier to exploitation.