The Bit Flows plugin contains a flaw that allows a malicious actor to include and execute arbitrary PHP files on the WordPress server by manipulating the 'image' field passed through an ImageHelper node when a webhook triggers a flow. This Local File Inclusion vulnerability (CWE‑98) enables the attacker to run arbitrary code by supplying a path to a PHP file that the application will include, thereby bypassing normal access controls. The impact rises from data exposure to full server compromise if the attacker can place and run PHP files on the file system.

Affected systems are WordPress sites running the Bit Flows plugin in versions up to and including 1.31.0. The issue is tied to any webhook‑triggered flow that uses the ImageHelper’s imageToBase64 node with a body field that references an arbitrary image source. Site administrators using the default configuration—no bearer secret and no IP allowlist—are the most vulnerable.

The CVSS base score of 5.9 places the vulnerability in the medium impact range. No EPSS score is published, and the vulnerability is currently not listed in the CISA KEV catalog, indicating no publicly known exploits yet. However, the exploit requires only unauthenticated access to the webhook endpoint and a pre‑existing webhook flow, conditions that are documented and legitimate usage scenarios. Because the attacker can trigger the inclusion without additional credentials, the likelihood of exploitation remains significant, especially on sites with open or default webhook configurations.