Vulnerabilities CVE-2026-15006

CVE-2026-15006

High

Open

TLP:CLEAR

Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Details

CVSS Score: 7.5
EPSS Score ⓘ: 0.84%

54.6th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Confidence: 90%
Published: Aug 1, 2026
Last Modified: Aug 3, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.