Bit Apps vulnerabilities

Products

• Bit Assist 2
• Bit Form 2
• Bit Integrations 1
• Bit SMTP 1

Latest Bit Apps CVEs

Newest publication first

1. CVE-2026-32519 WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability

   Published 2026-03-25

   Critical·CVSS 9.0

   Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2.

2. CVE-2026-25418 WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability

   Published 2026-02-19

   High·CVSS 7.6

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.

3. CVE-2025-68596 WordPress Bit Assist plugin <= 1.5.11 - Broken Access Control vulnerability

   Published 2025-12-24

   Medium·CVSS 5.3

   Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.

4. CVE-2025-30834 WordPress Bit Assist plugin <= 1.5.4 - Path Traversal vulnerability

   Published 2025-04-01

   High·CVSS 7.5

   Path Traversal: '.../...//' vulnerability in Bit Apps Bit Assist bit-assist allows Path Traversal.This issue affects Bit Assist: from n/a through <= 1.5.4.

5. CVE-2025-30885 WordPress Bit Form plugin <= 2.18.0 - Open Redirection vulnerability

   Published 2025-03-27

   Medium·CVSS 4.7

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through <= 2.18.0.

6. CVE-2025-30884 WordPress Bit Integrations plugin <= 2.4.10 - Open Redirection vulnerability

   Published 2025-03-27

   Medium·CVSS 4.7

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrations: from n/a through <= 2.4.10.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.