Published on 1 August 2026
An attacker who needs nothing more than the address of your website may be able to read out the wp-config.php file – and thereby obtain the database name, database user, password and the secret WordPress keys. That is exactly what a new security vulnerability in the widely used WordPress plugin "Bit Integrations" makes possible. On 1 August 2026 it was made public under the identifier CVE-2026-15006. The severity: high (CVSS 7.5). All plugin versions up to and including 2.9.0 are affected. Anyone using the plugin who has not yet updated should act now.
"Bit Integrations" is a so-called automation plugin: it connects WordPress forms with external services such as CRM systems (customer management), email marketing tools, Google Sheets or webhooks. In short: it automatically forwards form submissions to wherever they are needed. According to the manufacturer Bit Apps, the plugin is actively in use on more than 20,000 websites.
The processAttachment function – responsible for processing file attachments from forms – contains a programming error. Security researcher "daroo" discovered it and reported it to Wordfence, which acts as the official CVE numbering authority (CNA). The vulnerability carries the technical designation Path Traversal (error class CWE-22).
The tricky part: the attack works without a login and without any user interaction. A single manipulated request over the internet is enough. Wordfence describes it as follows:
"The Bit integrations plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information." – Wordfence Threat Intelligence
With a path traversal vulnerability, an application accepts a file path from the outside without checking it sufficiently. An attacker can then inject so-called "../" sequences (which in file systems mean "one directory up") into the path. This lets them leave the actually permitted directory and move freely through the server's file system.
Specifically affected within the plugin are the files MailController.php, CF7Controller.php and CF7/Hooks.php. The vulnerability is triggered in conjunction with an optional file field of the popular form plugin Contact Form 7 (CF7). Since the vulnerable function can be called without an authentication check, any external attacker can reach it.
Among the things that can be read out this way are:
The official CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Translated, this means: attack possible over the network, low complexity, no privileges required, no user interaction necessary, high loss of confidentiality. Integrity and availability are not directly affected – but, and this is crucial, the credentials read out open the door for follow-up attacks.
The real risk lies in the chain reaction: first, the attacker reads out the wp-config.php. It contains the database credentials. With these – provided the database is reachable – they can gain full access to all stored data: customer data, orders, form submissions. A pure "file read" quickly turns into a complete compromise.
To make matters worse, "Bit Integrations" as an automation platform typically stores API keys for numerous external services. If these keys are exposed, the connected CRM, email or cloud services can also be compromised.
You are affected if all of the following points apply:
At the time of publication, there were no reports of active exploitation. Nor is the vulnerability listed in the KEV catalogue of the US agency CISA (list of known actively exploited vulnerabilities). That is no reason to relax, however – according to Patchstack, the median time from publication to first mass exploitation of a WordPress vulnerability is just five hours.
The good news: a patch already exists. The manufacturer closed the vulnerability in version 2.9.1 (released on 13 July 2026) – notably 18 days before the public CVE announcement. The current version at the time of publication is 2.10.1 (30 July 2026). In the changelog, Bit Apps writes:
"Security – File Handling: Hardened attachment and upload path validation for Mail, PropovoiceCRM, SureCart and shared media upload helpers." – Bit Integrations Changelog 2.9.1
Proceed in this order:
For German SME operators, this vulnerability is also delicate from a data protection perspective. Since the read-out wp-config.php enables access to the database containing personal data, a successful exploitation can constitute a "personal data breach" within the meaning of Art. 4 No. 12 GDPR.
In this case, the notification obligation under Art. 33 GDPR applies: the data breach must be reported to the competent data protection supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. The notification must describe the nature and scope of the breach, the affected data categories, the likely consequences and the remedial measures taken (Art. 33(3) GDPR). Where there is a high risk to the data subjects, an additional notification of the affected individuals under Art. 34 GDPR is required.
It is also important to note: under Art. 32 GDPR, controllers are obliged to take appropriate technical measures to ensure the security of processing – this includes the prompt application of security patches. Failure to do so can be assessed as a breach and result in fines under Art. 83 GDPR of up to EUR 10 million or 2% of annual global turnover.
A frequently cited counterargument is the zero-day case. The Regional Court of Krefeld clarified in its ruling of 6 November 2025 (ref. 3 O 93/24):
"The defendants are merely obliged to take appropriate measures aimed at preventing a data protection breach as far as possible. This is not equivalent to all measures that exhaust the state of the art."
But be careful: CVE-2026-15006 is not a zero-day case. The patch (version 2.9.1) was already available on 13 July 2026 – 18 days before the CVE publication. Anyone who did not apply the update before a possible exploitation cannot invoke the zero-day argument. The internal documentation obligation under Art. 33(5) GDPR applies regardless of any notification obligation anyway.
CVE-2026-15006 is already the third security-relevant CVE for "Bit Integrations" within less than 18 months – after CVE-2025-30884 (Open Redirect, March 2025) and CVE-2026-11989 (SSRF, June 2026). This accumulation points to structural security problems in the plugin and should be taken into account when assessing your risk.
A look at the overall picture underscores the urgency: WordPress powers 43.5% of all websites worldwide, making it the largest attack target. According to Patchstack's "State of WordPress Security in 2026", 2025 saw a record of 11,334 new WordPress vulnerabilities – 42% more than the previous year. 91% of all vulnerabilities originate from plugins, only 2% from the WordPress core. And in the first half of 2025, 57% of vulnerabilities required no authentication whatsoever – just like this one.
"The weighted median time to first mass exploitation was five hours. Regular plugin updates are the second line of defence, but as attackers weaponize new vulnerabilities within mere hours, this is not a viable defence." – Patchstack, State of WordPress Security in 2026
This statement makes it clear: purely manual updates are often no longer enough given the current speed of attackers. A WAF as a first line of defence and automatic updates are not a luxury but basic equipment.
CVE-2026-15006 is a serious vulnerability with a high risk: exploitable unauthenticated, without user interaction, with low attack complexity – and with the potential, via the wp-config.php, to lead to a complete compromise of your website and the personal data stored on it. Affected are an estimated 8,000 to 12,000 of the more than 20,000 installations, provided they have not yet been updated.
The crucial good news: the patch has been available for a long time. If you use "Bit Integrations", update now to version 2.9.1 or higher – ideally the current 2.10.1. Check your server logs, rotate your credentials if in doubt, and document the process for your GDPR accountability obligation. Anyone who applies the update promptly is on the safe side.