Local File Inclusion Vulnerability in Bit Flows Plugin for WordPress
CVE-2026-110185

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Bit Flows: Ai Agent Automation & Integrations For Forms, Crm, Ecommerce, Google Sheets, And More
Vendor
CVE Published:
28 October 2026

What is CVE-2026-110185?

The Bit Flows plugin for WordPress is susceptible to a Local File Inclusion vulnerability affecting all versions up to 1.31.0. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server via the 'image' parameter associated with the ImageHelper node's mix tag. The exploitation of this vulnerability is facilitated under specific conditions where an administrator has configured a webhook-triggered flow without enforcing security measures like bearer secrets or IP allowlists. In such cases, attackers may bypass access controls, extract sensitive information, or execute arbitrary PHP code, posing significant security risks.

Affected Version(s)

Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More 0 <= 1.31.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/bit-pi/tags/1....
https://plugins.trac.wordpress.org/browser/bit-pi/tags/1....

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.