CVE-2026-15006
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The Bit integrations plugin for WordPress up to version 2.9.0 has a Directory Traversal vulnerability in the processAttachment function. Unauthenticated attackers can read arbitrary files on the server, including sensitive information.
Risk Assessment
An attacker can access configuration files, passwords, or other confidential data stored on the server.
Recommendation
Update the Bit integrations plugin to version 2.9.1 or later if available. In the meantime, restrict access to the plugin to trusted users only.
Other vulnerabilities in Bit integrations
See all- CVE-2026-104749High
The Bit integrations plugin for WordPress is vulnerable to privilege escalation via log re-execution in all versions up to and including 2.10.6. Unauthenticated attackers can overwrite the administrator's password and take over the administrator account.
- CVE-2026-102007High
The Bit Integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress in all versions up to and including 2.10.6 is vulnerable to Stored Cross-Site Scripting via the field mapped to notification_content (attacker-chosen key, e.g. payload_text) due to insufficient input sanitization and output escaping. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow binding the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.
Original NVD description (English source)
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS