Bit Form

Bit Form through 3.2.0 allows an administrator to submit crafted data[queryCondition] input to the authenticated bitforms_get_form_entries AJAX action. AdminFormHandler::getFormEntry() passes that condition to FormEntryModel::get(), whose pre-fix condition formatter accepted attacker-selected keys and operators and allowed a raw SQL fragment. Version 3.2.1 introduces an allowlist for columns and operators, rejects request-supplied raw conditions, validates identifiers and fails closed on invalid input. Exploitation can disclose or alter database data available to the WordPress connection.

Bit Form before 3.2.0 accepts a public form's uploaded signature image without sanitizing SVG content before storage. An unauthenticated submitter can upload an SVG containing JavaScript, which runs in the WordPress site origin when the stored file is viewed and can target administrative users who inspect submissions. This unscored record received deeper review because it combines an unauthenticated upload primitive with stored XSS. The CNA does not disclose the form endpoint, upload parameter or stored file path.

Bit Form before 3.1.4 does not sanitize a conversational-form display setting before rendering it on the public form. A high-privileged user can store JavaScript in that setting, which executes for any visitor who views the form. This is a meaningful multisite boundary because subsite Administrators do not normally hold unfiltered_html; the published record does not disclose the setting name, save action, renderer or exact payload encoding.

Bit Form before 3.1.2 exposes public AJAX handlers including bitforms_submit_form and bitforms_trigger_workflow without enforcing the selected form's active status. An unauthenticated visitor can submit bitforms_id for a deactivated or unpublished form; FrontendAjax::submit_form() passes it to FrontendFormManager::handleSubmission(), creating an entry and firing that form's configured workflows. Depending on the form, those workflows can send email or invoke other configured integrations. Version 3.1.2 calls checkStatus() before submission, validation, entry update, hidden-field loading and workflow execution and rejects inactive forms with HTTP 403.

Bit Form is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 3.1.0. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 3.1.0. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.1.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form – Contact Form Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form builder is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by server-side request forgery. Exploitation requires an authenticated administrator account. The vulnerable server can be induced to make attacker-selected network requests. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by filesystem traversal. Exploitation requires an authenticated administrator account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by code execution. Exploitation requires an authenticated administrator account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by filesystem traversal. Exploitation requires an authenticated administrator account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by a security weakness. Exploitation requires an authenticated administrator account. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by dangerous file upload. Exploitation requires an authenticated administrator account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Bit Form is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.