The Bit Form plugin for WordPress contains an open redirect flaw. A crafted URL can be used to send visitors to any site that the attacker chooses. This vulnerability can facilitate phishing attacks, allowing attackers to impersonate legitimate content and trick users into submitting credentials or other sensitive data. The weakness corresponds to CWE‑601.

Bit Apps Bit Form plugin, all releases through version 2.18.0. Any WordPress site that has this plugin installed and configured with the redirect functionality exposed is affected. Versions 2.18.1 and later are not affected.

With a CVSS score of 4.7, the vulnerability presents moderate risk. The EPSS score of less than 1% indicates a very low exploitation probability at present. It is not listed in the CISA KEV catalog. The likely attack vector is via a malicious link that the attacker embeds in emails or social media posts, exploiting the redirect endpoint of the plugin. Successful exploitation results in user redirection to a malicious site but does not grant further access to the server or data.