{"data":{"id":"6a1d2fad-894c-47db-9cef-9b47732fc497","title":"CVE-2026-110185: The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for…","summary":"The Bit Flows AI Agent Automation plugin for WordPress, in all versions up to and including 1.31.0, has a Local File Inclusion flaw in the 'image' parameter, which maps to any body field referenced by the ImageHelper node's mix tag. Unauthenticated attackers can include and execute arbitrary .php files on the server, enabling code execution, access control bypass, or sensitive data access. Exploitation requires an administrator to have built a webhook-triggered flow piping a body field into an ImageHelper imageToBase64 node, with the webhook left in its default configuration (no bearer secret, no IP allowlist).","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110185","publishedAt":"2026-10-28T07:16:46.203Z","cveId":"CVE-2026-110185","cweIds":["CWE-98"],"cvssScore":"5.9","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["The Bit Flows: AI Agent Automation & Integrations plugin","WordPress"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"The Bit Flows WordPress plugin local file inclusion through webhook image field","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-28T12:08:30.218Z","kevDateAdded":null,"advisoryAliases":["GHSA-g7h8-64g3-rpm4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-28T12:08:33.644Z","patchAvailable":null,"disclosureDate":"2026-10-28T07:16:46.203Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}