SQL Injection in Bit Form: CVE-2026-16810 Threatens Databases

Published on 15 August 2026

A single mishandled parameter can be enough to read out the entire database of a WordPress website – including your customers' stored form submissions. That is exactly what CVE-2026-16810 is about, a SQL injection vulnerability in the widely used form plugin Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder. All versions up to and including 3.2.0 are affected. According to the official WordPress.org API, the plugin is installed on more than 10,000 active websites. If you use Bit Form for your contact, booking or payment forms, you should act now.

What happened?

On 14 August 2026, the vulnerability CVE-2026-16810 was publicly documented. It is what is known as a SQL injection – an attack in which an attacker "injects" additional database commands into an existing query via an input field or parameter. The database then executes these additional commands as though they were legitimate.

Specifically, the problem lies in the data[queryCondition] parameter. Through this value, additional SQL fragments can be appended to an already existing database query. The documented consequence: an attacker can read sensitive information out of the website database. Since the database behind a WordPress website contains almost everything – user accounts, password hashes, settings and, yes, stored form submissions – the potential for damage is considerable.

The security researchers at Wordfence describe the flaw as follows:

„This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.“ – Wordfence PRISM

In plain terms: an already logged-in attacker with administrator privileges can append additional SQL queries to existing queries and thereby read sensitive data out of the database.

Technical background – explained clearly

The vulnerability is classified under CWE-89 (SQL injection). The cause is a classic programming error: the user-controlled input is not sufficiently "escaped" (i.e. prepared so that special characters are not interpreted as commands), and the existing SQL query is not securely prepared. As a result, additional input content is not treated as a pure value but as an executable database command.

The official CVSS 3.1 score is 6.5 (Medium). The associated vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. Translated, that means:

• Reachable over the network (AV:N) – the attack is possible remotely.
• Low attack complexity (AC:L) – no major technical hurdle.
• High privileges required (PR:H) – the attacker needs an administrator account.
• No user interaction required (UI:N).
• High impact on confidentiality and integrity (C:H, I:H), none on availability (A:N).

An important point for context: the administrator privileges as a prerequisite limit the attack surface. Any random website visitor cannot simply exploit the flaw. But this is explicitly not an all-clear: if an admin account is compromised, granted too generously or managed sloppily by an external agency, this protection no longer applies.

A note on accuracy: the Wordfence headline refers to the vulnerability differently as the "filterText" parameter, while the detailed description and the NVD database name data[queryCondition]. For the technical detail we rely on the concurring detailed description from NVD and Wordfence.

Who is affected?

All websites running Bit Form in a version up to and including 3.2.0 are affected. The WordPress.org plugin API lists 10,000 active installations for Bit Form. Important for context: this figure is the installation base, not the number of actually vulnerable websites. It also includes installations that have already been updated. How many websites still use the vulnerable version has not been published – nor have figures on affected companies or compromised records.

For German small and medium-sized enterprises, the flaw is particularly relevant if Bit Form is used for the following purposes and stores submissions in the WordPress dashboard:

• Contact and enquiry forms
• Quotation, booking and application forms
• Support and ticket forms
• Payment forms
• File upload forms

It is precisely in these forms that personal data often ends up – names, email addresses, phone numbers, sometimes even payment or application data. That is exactly what makes the flaw commercially relevant for you.

Is the flaw already being actively exploited? As of the verified status on 14 August 2026, there is no confirmed public proof of concept and no confirmed active exploitation. In particular, the CISA KEV catalogue (the US agency's register of known actively exploited vulnerabilities) contained no entry for CVE-2026-16810. This is a snapshot of the source status, not a guarantee – and it does not change the urgency of updating.

How to check whether you are affected

1. Log in to the WordPress backend with an authorised account and open Plugins > Installed Plugins. Search for "Bit Form" or the plugin slug bit-form.
2. Read off the displayed version number. If Bit Form is active in version 3.2.0 or older, your installation falls within the affected range. Version 3.2.1 or higher is patched according to Wordfence.
3. If backend access is not possible, have your hosting provider, agency or administrator check the installed version in the directory wp-content/plugins/bit-form or in its readme.txt. Old versions no longer needed should also be recorded and removed.
4. Determine whether Bit Form stores submissions and which data categories they contain. The plugin page names, among other things, contact, registration, booking, payment and file upload forms as well as the storage of submissions in the dashboard.
5. Review all administrator accounts, external agency access and existing login and audit logs for unknown logins or changes. Because exploitation requires administrator privileges, this privilege review is central to assessing the risk.

What you need to do now

A patch already exists. The vendor Bit Apps implemented the security hardening in version 3.2.1 of 28 July 2026. At the time of research, WordPress.org was already shipping version 3.2.2 (published according to the changelog on 3 August 2026). The official changelog for 3.2.1 describes the measure as follows:

„Hardened the database query layer so a query condition can never contribute an unrecognised column name or comparison operator to a statement.“ – Bit Apps, WordPress.org changelog

In other words, the database query layer was hardened so that a query condition can no longer contribute an unknown column name or comparison operator to a statement. The vendor also thanks the security researchers Artus KG, JING QIAN and Farid Narimanov for the responsible disclosure.

Your concrete steps:

1. Create a backup. Before updating, create a current, tested backup of files and database. The WordPress documentation recommends a current backup before every plugin update.
2. Update immediately. Bring Bit Form to at least 3.2.1, preferably to the current version 3.2.2. Afterwards, check the core functions: forms, email notifications, payment flows, integrations and submission management.
3. Deactivate if necessary. If a prompt update is not possible, temporarily deactivate Bit Form and, where appropriate, replace particularly data-intensive forms with a vetted alternative process. Deactivation stops regular execution – but it is no substitute for an update or for a forensic review in the event of suspicion.
4. Clean up admin privileges. Limit WordPress administrator privileges to the people who actually need them, remove orphaned accounts and secure the remaining admin access with strong, individual passwords and multi-factor authentication. This step directly addresses the documented prerequisite of high privileges.
5. Check immediately if suspicious. If you suspect abuse, immediately check credentials, sessions, administrators, relevant logs and form submissions. Preserve evidence and timestamps. Involve your data protection officer or the responsible parties early if personal data could be affected.
6. Establish processes. Introduce a binding plugin inventory, prompt patch management and regular security reviews. A web application firewall can be an additional layer of protection – but for this authenticated flaw it is no substitute for patching and clean privilege management.

Assessment and GDPR relevance

According to its own WordPress.org description, Bit Form can store form submissions in the dashboard and is used for contact, registration, booking, payment and file upload forms. If unauthorised access to personal submissions actually took place, this in principle suggests a personal data breach within the meaning of Art. 4(12) GDPR.

Concrete obligations can arise from this:

• Art. 32 GDPR requires risk-appropriate technical and organisational measures – a prompt update is one of them.
• Art. 33 GDPR obliges the controller to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, provided a risk to the rights and freedoms of the persons concerned is likely. In addition, all data breaches must be documented.
• Art. 34 GDPR generally also requires the affected persons to be notified without undue delay where a high risk is likely.

Whether these conditions are met in a specific case depends on the demonstrable access, the types of data affected, the scope and the protective measures taken, and must be assessed on a case-by-case basis. This is a general assessment and not legal advice.

That data protection authorities are giving the matter weight is shown by a statement from the then Federal Commissioner for Data Protection and Freedom of Information, Ulrich Kelber:

„Datenschutz ist Grundrechtsschutz. Die ausgesprochenen Geldbußen sind ein klares Zeichen, dass wir diesen Grundrechtsschutz durchsetzen werden.“ – Ulrich Kelber, BfDI

The bigger picture

Bit Form is not an isolated case. The security provider Patchstack reports a total of 11,334 new WordPress vulnerabilities for 2025, of which 91 percent were found in plugins. Specifically, SQL injection accounted for 7.2 percent of the recorded WordPress vulnerabilities in the first half of 2025, according to Patchstack. In the fourth quarter of 2025, Wordfence counted 107 entries of the CWE-89 (SQL injection) class alone in its database. These industry figures are not a measurement for Bit Form, but they show one thing: plugin vulnerabilities are the dominant entry point in WordPress.

One further note for context: there was already a different Bit Form case previously, CVE-2026-16573 – an unauthenticated stored XSS flaw via SVG signature images before version 3.2.0. This case is technically distinct from CVE-2026-16810, but it should sharpen your awareness that a current update is generally important.

Conclusion

CVE-2026-16810 is classified as "medium" with a CVSS score of 6.5 – but for an SME that must not be confused with "low business risk". The prerequisite of an administrator account lowers the danger from anonymous mass attacks, but a compromised or overly broadly granted admin account is enough to read out sensitive database contents. It is precisely such data – contact enquiries, bookings, payment data – that is highly relevant to your business and your GDPR obligations.

The good news: a patch exists. Anyone using Bit Form should now do two things in parallel – promptly update to version 3.2.1, better 3.2.2 and at the same time critically review administrator privileges. Together with a clean backup and orderly patch management, the risk is then manageable. Don't wait for the first public exploit – act while the flaw exists only on paper.