Executive brief
Bit Form is a WordPress plugin that enables users to create contact forms, payment forms, and custom forms on their websites. The plugin contains a SQL injection flaw in its form query handling that allows authenticated administrators to inject malicious SQL commands, potentially exposing sensitive database information including user records and other confidential data stored in the site's database.
Technical details
The vulnerability is a SQL injection flaw in the 'data[queryCondition]' parameter, affecting Bit Form versions up to 3.2.0. The root cause is insufficient escaping of user-supplied input combined with improper SQL query preparation in the form handling code. The attack requires authenticated access with administrator-level privileges and network reachability to the WordPress admin interface. An attacker with these permissions can inject arbitrary SQL commands into the query condition parameter to extract sensitive data from the database. The vulnerability is documented in CVE-2026-16810, though patch availability at the advisory publication date is not specified.
Affected products
- Wordpress.org Bit Form up to and including 3.2.0
Timeline
- 2026-08-14: disclosed