Junglewise Threat Intelligence

CVE-2026-15006: BitPress Bit Integrations directory traversal in processAttachment

CVE-2026-15006 · Severity: high · CVSS 7.5 · Published 2026-08-01

Executive brief

The Bit Integrations plugin for WordPress, which connects website forms to external services like CRMs and spreadsheets, contains a security flaw. This vulnerability allows an unauthorized person to access and read sensitive files stored on the website's server. This could lead to the exposure of configuration files, passwords, or other private data, potentially compromising the entire website.

Technical details

A directory traversal vulnerability exists in the Bit Integrations WordPress plugin due to insufficient input validation in the processAttachment function. Specifically, the plugin fails to properly sanitize file paths provided by users, allowing an unauthenticated attacker to use 'dot-dot-slash' (../) sequences to navigate outside of the intended directory. This enables the retrieval of sensitive system files, such as wp-config.php or other server-level configuration files, via a network request. The issue affects all versions up to and including 2.9.0. A patch is available in subsequent versions.

Affected products

  • BitPress Bit Integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation <= 2.9.0

Timeline

  • 2026-08-01: advisory: NVD publication date

References

Related threats