Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-11989— Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping

CVSS 6.5 · Medium EPSS 0.50% · P40

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProductVersion RangeStatus
bitpressadminBit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation≤ 2.8.7affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-11989

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
Source: CVE Program / CVE List V5
Vulnerability Description
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.7 via the upload_attachment. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires a form integration to be configured with a field mapped to a WooCommerce product image, product gallery, downloadable files, or Google Contacts attachment field, which is a default use case for these integrations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Bit Apps Bit integrations 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bit Apps Bit integrations是Bit Apps公司的一款提供表单集成、网络钩子、电子表格、CRM、LMS及邮件自动化等功能的集成插件。 Bit Apps Bit integrations 2.8.7及之前版本存在服务端请求伪造漏洞，该漏洞源于通过upload_attachment存在服务端请求伪造，可能导致未经身份验证的攻击者从Web应用程序发起对任意位置的请求，从而查询和修改内部服务信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
bitpressadminBit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation 0 ~ 2.8.7 -

II. Public POCs for CVE-2026-11989

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-11989

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-11989 (6)

Vendor Advisories for CVE-2026-11989 (1)

Other References for CVE-2026-11989 (1)

IV. Related Vulnerabilities

Same product: Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
Same vendor: bitpressadmin
Same weakness: CWE-918

V. Comments for CVE-2026-11989

No comments yet

Leave a comment