Bit Form WordPress plugin vulnerabilities

The Bit Form plugin for WordPress, up to and including version 3.2.0, is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on public submission handlers. Unauthenticated users can submit entries to deactivated or unpublished forms and trigger configured workflows like email notifications.

The Bit Form WordPress plugin before version 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email. This allows unauthenticated attackers to read arbitrary server files, such as the WordPress configuration file.