CVE-2026-16810: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-16810 is a SQL Injection vulnerability in the Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress, affecting all versions up to and including 3.2.0. The flaw exists in the data[queryCondition] parameter due to insufficient input escaping and lack of prepared SQL statements, allowing authenticated attackers with administrator-level access to append arbitrary SQL queries. It was published on August 14, 2026, with Wordfence as the assigning CNA. The CVSS v3.1 base score is 6.5 (Medium) (Github Advisory, Wordfence).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is twofold: user-supplied input in the data[queryCondition] parameter is not properly escaped, and the existing SQL query lacks sufficient preparation (i.e., parameterized/prepared statements are not used). The vulnerable code paths are traceable through AdminAjax.php (line 754), AdminFormHandler.php (line 2042), Model.php (line 424), and GlobalHelper.php (line 53) in the plugin's version 3.2.0 source (Github Advisory, Wordfence). Exploitation requires network access and administrator-level authentication, making the attack vector network-based with high privilege requirements.

Successful exploitation allows authenticated administrators to extract sensitive information from the WordPress database, including user credentials, personal data stored in form submissions, and other confidential site data. The CVSS scoring reflects high confidentiality and integrity impact with no availability impact, meaning data can be read and potentially manipulated but service disruption is not a direct consequence. While the requirement for administrator-level access limits the attack surface, a compromised admin account or a malicious administrator could leverage this flaw to fully enumerate the WordPress database (Github Advisory, Wordfence).

As of the disclosure date (August 14, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Bit Form plugin at version 3.2.0 or earlier using tools like WPScan or by inspecting plugin metadata exposed in the site's source or /wp-content/plugins/bit-form/readme.txt.
2. Obtain Administrator Access: Authenticate to the WordPress admin panel using valid administrator credentials (obtained via phishing, credential stuffing, or other means).
3. Locate the Vulnerable Endpoint: Navigate to the admin AJAX handler that processes the data[queryCondition] parameter, as exposed through AdminAjax.php (line 754) and AdminFormHandler.php (line 2042).
4. Craft Malicious Payload: Construct an HTTP POST request to the WordPress AJAX endpoint (e.g., /wp-admin/admin-ajax.php) with a manipulated data[queryCondition] value containing appended SQL syntax, such as ' UNION SELECT user_login, user_pass, 1 FROM wp_users-- -.
5. Extract Database Contents: Submit the crafted request and parse the response to retrieve sensitive database records, including WordPress user credentials, form submission data, or other stored information (Github Advisory, Wordfence).

• Network: Unusual or repeated POST requests to /wp-admin/admin-ajax.php containing SQL metacharacters (e.g., ', --, UNION, SELECT) in the data[queryCondition] parameter body.
• Logs: WordPress or web server access logs showing admin AJAX requests with anomalous or encoded query condition values; database error logs reflecting malformed SQL queries or unexpected query structures.
• Process/Application: Unexpected database query results or data exports initiated from the Bit Form plugin's admin interface; unusual spikes in database read activity correlated with admin sessions.

Update the Bit Form plugin to a version newer than 3.2.0, which contains the fix for this SQL injection vulnerability. As an interim measure, restrict administrator-level access to trusted users only and enforce strong, unique passwords with multi-factor authentication on all admin accounts. Deploying a Web Application Firewall (WAF) with rules to detect and block SQL injection patterns can provide an additional layer of defense. Monitor database query logs for suspicious activity indicative of SQL injection attempts (Github Advisory, Wordfence).