CVE-2026-110185 The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to L
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-110185?
CVE-2026-110185 is a medium-severity vulnerability in bitpressadmin Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More, published on 28 Oct 2026.
Official description
The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case.
Weakness: CWE-98
Which versions are affected by CVE-2026-110185?
How do I fix CVE-2026-110185?
No fix has been published for CVE-2026-110185 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110185 being exploited?
There is no known exploitation of CVE-2026-110185 in the wild and no public exploit code.
Sources
Also known as GHSA-g7h8-64g3-rpm4.