File and Path Handling

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File FieldCVE-2026-15006bitpressadmin · CVSS 7.5 · 1.2% likely

   CWE-22

2. Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File UploadCVE-2024-7770bitpressadmin · CVSS 8.8 · 1.1% likely

   CWE-434

3. Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' ParameterCVE-2026-14372bitpressadmin · CVSS 7.1 · 1.1% likely

   CWE-22

4. Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary Fil…CVE-2024-7777bitpressadmin · CVSS 9 · 1.0% likely

   CWE-22

5. Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File UploadCVE-2024-6123bitpressadmin · CVSS 7.2 · 1.0% likely

   CWE-434

6. Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary Fil…CVE-2024-7782bitpressadmin · CVSS 8.7 · 0.9% likely

   CWE-22

7. Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File UploadCVE-2025-6679bitpressadmin · CVSS 9.8 · 0.9% likely

   CWE-434

8. Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File UploadCVE-2024-8743bitpressadmin · CVSS 6.8 · 0.8% likely

   CWE-434

9. Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile FunctionCVE-2024-13791bitpressadmin · CVSS 4.9 · 0.7% likely

   CWE-23

10. Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID ParameterCVE-2025-0822bitpressadmin · CVSS 6.5 · 0.6% likely

    CWE-23

11. Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Paramete…CVE-2026-110185bitpressadmin · CVSS 5.9 · 0.6% likely

    CWE-98

12. Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadsCVE-2025-1725bitpressadmin · CVSS 6.4 · 0.2% likely

    CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.