CVE-2026-15006

Name of the Vulnerable Software and Affected Versions Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation versions prior to 2.9.1

Description This plugin contains a Directory Traversal flaw within the processAttachment() function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. Directory Traversal is a security gap that allows an attacker to access files and directories stored outside the web root folder.

Recommendations Update the plugin to a version newer than 2.9.0. As a temporary workaround, consider restricting access to the processAttachment() function until the update is applied.