The Bit integrations plugin for WordPress contains an SSRF flaw in the upload_attachment handling code that permits unauthenticated users to instruct the server to make HTTP or HTTPS requests to any URL. This behavior allows attackers to read or modify data on internal hosts that are normally unreachable from the outside, potentially exposing sensitive information or altering internal services. The weakness arises from improper validation of the requested resource and is classified as CWE‑918.

WordPress sites that have installed the Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin in any version up to and including 2.8.7. The vulnerability is triggered when a form integration is configured with a mapping to a WooCommerce product image, product gallery, downloadable files, or a Google Contacts attachment field – all common default configurations.

The CVSS score of 6.5 indicates a moderate severity, yet the vulnerability can be triggered by any visitor to the site without authentication. Exploitability does not require additional privileges or knowledge of secrets; an attacker simply creates or targets a vulnerable form mapping. Because the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the publicly known exploitation rate is uncertain, but the attack vector remains highly feasible for determined adversaries seeking internal reconnaissance or modification.