CVE-2026-15006
Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
| CWE | CWE-22 |
| Vendor | bitpressadmin |
| Product | bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation |
| Published | Aug 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for bitpressadmin bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation
Be the first to know when new high vulnerabilities affecting bitpressadmin bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
bitpressadmin / Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
0 ≤ 2.9.0
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/9b00da60-7d2d-467e-ab58-0bb4af0cbda5?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.9.0/backend/Actions/Mail/MailController.php#L123 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.9.0/backend/Actions/Mail/MailController.php#L59 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.9.0/backend/Triggers/CF7/CF7Controller.php#L127 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.9.0/backend/Triggers/CF7/Hooks.php#L11 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.8.11/backend/Actions/Mail/MailController.php#L123 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.8.11/backend/Actions/Mail/MailController.php#L59 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.8.11/backend/Triggers/CF7/CF7Controller.php#L127 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.8.11/backend/Triggers/CF7/Hooks.php#L11 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&old=3605525%40bit-integrations&new=3605525%40bit-integrations
Credits
daroo