Description

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-14T06:17:03.253Z",
  "pubdate": "2026-08-14T06:17:03.253Z",
  "executiveSummary": "An authenticated SQL Injection vulnerability has been identified in the Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress, spanning all versions up to, and including, 3.2.0.\nThe flaw exists due to insufficient escaping of user-supplied input provided via the 'data[queryCondition]' parameter and a lack of proper parameterization on existing database queries within the application.\nThis security deficiency enables authenticated attackers possessing administrator-level access or higher to manipulate database queries by appending arbitrary SQL statements.\nSuccessful exploitation of this vulnerability allows threat actors to extract sensitive information directly from the underlying database, potentially compromising the confidentiality and integrity of the entire WordPress installation.\nWhile the vulnerability requires elevated administrative privileges to exploit, it presents severe risk implications in multi-admin environments or scenarios where administrative accounts have been compromised.\nNo specific exploitation vectors outside of authenticated administrative access are detailed, but the impact remains critical due to the unrestricted database access inherent to SQL injection primitives.",
  "technicalDetails": "The root cause of this vulnerability stems from improper input sanitization and inadequate query preparation in the handling of database operations within the Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin.\nSpecifically, the vulnerable component processes the 'data[queryCondition]' parameter without applying sufficient escaping mechanisms or utilizing prepared statements, thereby directly incorporating untrusted user input into the application's SQL queries.\nThe vulnerability affects all versions of the plugin up to, and including, 3.2.0.\nExploitation of this flaw requires the attacker to possess authenticated access with administrator-level privileges or higher within the WordPress application.\nThe attack flow begins when an authenticated administrator submits a crafted HTTP request containing malicious SQL payloads injected into the 'data[queryCondition]' parameter.\nBecause the application fails to properly sanitize the input or utilize parameterized queries, the injected SQL syntax is interpreted and executed by the underlying database management system as part of the existing query structure.\nThis allows the attacker to break out of the intended query logic and append additional SQL queries, facilitating techniques such as union-based or error-based data extraction.\nThe post-exploitation impact includes the unauthorized retrieval of sensitive information stored in the database, such as user credentials, configuration data, and potentially other confidential records accessible via the database connection."
}