The Bit integrations WordPress plugin allows an unauthenticated user to request an arbitrary file path through its processAttachment function, which lacks proper path sanitization. This results in the server returning the contents of any readable file, including configuration files that may contain credentials. The flaw is a classic directory traversal (CWE‑22) and can lead to the disclosure of sensitive data if privileged files are accessed; lateral movement is inferred if such files are compromised.

All released builds of the Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin up to and including version 2.9.0 are affected. WordPress sites that have these plugin versions installed are susceptible to the file‑read vulnerability.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a low short‑term exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred: based on the description, it is inferred that an attacker can trigger the flaw by sending a crafted HTTP request to the plugin’s attachment endpoint, which processes the optional Contact Form 7 file field. Successful exploitation results in confidentiality compromise; it is inferred that code execution or privilege escalation is not granted on its own.