CVE-2026-16810

Name of the Vulnerable Software and Affected Versions Bit Form versions prior to 3.2.1

Description The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress contains a generic SQL Injection flaw. This occurs because the plugin fails to sufficiently escape user-supplied parameters and lacks proper preparation of the SQL query. Authenticated attackers with administrator-level access or higher can exploit this by appending additional SQL queries via the data[queryCondition] parameter to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 3.2.0.