Executive brief
Bit Form is a WordPress plugin used to create and manage contact forms. A security flaw allows unauthenticated attackers to trick the system into sending them sensitive server files, such as the WordPress configuration file containing database credentials. This could lead to a full site takeover or unauthorized access to customer data.
Technical details
A path traversal vulnerability exists in the Bit Form plugin for WordPress prior to version 3.1.0. The plugin fails to validate or sanitize the file-field value in form submissions before using it as a file path for email attachments. An unauthenticated attacker can provide a traversal string (e.g., ../../../wp-config.php) in a file-upload field. If the form is configured with an autoresponder or notification email that includes the file field as an attachment, the plugin will read the specified file from the server and email it to the attacker-controlled address. This requires a form to be configured with a file field and an active email notification workflow.
Affected products
- Bit Apps Bit Form < 3.1.0
Timeline
- 2026-06-30: disclosed: Publicly published by WPScan
- 2026-07-21: advisory: NVD published date
- 2026-06-30: patched: Fixed in version 3.1.0