Junglewise Threat Intelligence

CVE-2026-11989: BitPress Bit Integrations SSRF in upload_attachment

CVE-2026-11989 · Severity: medium · CVSS 6.5 · Published 2026-06-19

Executive brief

The Bit Integrations plugin for WordPress, which connects website forms to external services like CRMs and spreadsheets, contains a security flaw. This vulnerability allows unauthorized individuals to force the website to make requests to internal or external servers. This could lead to the exposure of sensitive information from internal services that are not normally accessible from the internet.

Technical details

The Bit Integrations plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the 'upload_attachment' function in versions up to and including 2.8.7. The flaw exists because the application does not sufficiently validate user-supplied URLs before making backend requests. An unauthenticated attacker can exploit this to make web requests to arbitrary locations, potentially interacting with internal services or metadata endpoints. Exploitation requires a form integration to be configured with specific field mappings, such as WooCommerce product images or Google Contacts attachments. A patch has been released in subsequent versions.

Affected products

  • BitPress Bit Integrations <= 2.8.7

Timeline

  • 2026-06-19: disclosed
  • 2026-06-19: advisory

References

Related threats