The Bit Form WordPress plugin release before 3.1.0 allows the value of a form file‑field to be supplied without restricting the target path, satisfying CWE‑22. This flaw gives unauthenticated users the ability to craft a file name that resolves to any file on the server, which the plugin then reads and attaches to a notification email. An attacker can therefore retrieve the contents of arbitrary files, such as the WordPress configuration or other sensitive data, exposing credentials and other secrets.

Any WordPress site that has the Bit Form plugin installed with a version lower than 3.1.0 is affected. The vulnerability arises in the form field handling component of the plugin, which relies on user‑supplied input to locate files without path validation. All releases preceding 3.1.0 are included in the advisory.

The CVSS score of 5.9 conveys a medium severity for the flaw. The EPSS value of less than 1% indicates that the likelihood of exploitation within this year is low, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an unauthenticated web request that sets a file‑field to a path containing traversal sequences. The likely attack vector is an HTTP request to the Bit Form plugin's file‑handling endpoint, which is publicly accessible. Because the attacker only needs to send a crafted HTTP request, no prior credential or privilege escalation is required.