CVE-2026-15006

HIGH · 7.5

hype MOSTLY HYPE · 22 hack

Recycled NVD feed posts; no PoC, KEV, or defender signals; pure disclosure chatter.

What: Directory traversal in Bit Integrations WordPress plugin (≤2.9.0) allowing unauthenticated attackers to read arbitrary server files; CVSS 7.5 HIGH.

Why it matters: Published today with no KEV listing or public PoC reported yet. Social chatter is automated vulnerability feed syndication rather than exploitation signals. Plugin affects WordPress deployments widely, but no defender triage or urgent vendor patching advisories visible in the posts. Early-stage disclosure with moderate impact if exploited.

Where it's seen: Vulnerability feeds (Patchstack radar, The Hacker Wire) republishing the NVD entry same-day; generic infosec social alerts with no exploitation context or patch availability mentioned.

RISK: ELEVATED — Unauthenticated file read on popular plugin; no patch yet; affects many WordPress sites.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 8/1/2026, 1:13:13 PM

Description

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 breakdown

Exploitability 3.9 · Impact 3.6

vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weaknesses

CWE-22

References

Other · 10