CVE-2025-30885: Bit Form Open Redirect Vulnerability

CVE-2025-30885 Overview

CVE-2025-30885 is an open redirect vulnerability affecting the Bit Apps Bit Form plugin for WordPress. The flaw exists in all versions of bit-form up to and including 2.18.0. Attackers can craft URLs that appear to originate from a legitimate WordPress site but redirect victims to attacker-controlled destinations. This behavior enables phishing campaigns that leverage the trust of the vulnerable domain.

The issue is classified under [CWE-601] URL Redirection to Untrusted Site. Exploitation requires user interaction, typically clicking a crafted link.

Critical Impact
Attackers can abuse trusted WordPress domains running Bit Form to redirect users to phishing pages, credential harvesters, or malware delivery infrastructure.

Affected Products

Bit Apps Bit Form WordPress plugin (bit-form)
All versions from n/a through 2.18.0
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-03-27 - CVE-2025-30885 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30885

Vulnerability Analysis

The Bit Form plugin accepts a redirect parameter without validating that the target URL points to an allowed destination. When the plugin processes a request containing this parameter, it issues an HTTP redirect to the supplied value. An attacker sends a victim a link on the legitimate WordPress domain, and the browser follows the redirect to an attacker-controlled host.

Because the initial URL uses the trusted domain, users and security controls that rely on domain reputation may treat the link as safe. The vulnerability affects confidentiality at a limited scope but does not directly compromise integrity or availability of the host system.

Root Cause

The plugin fails to enforce an allowlist or same-origin check on user-supplied redirect targets. Input validation for URL parameters used in wp_redirect() or equivalent flows is missing or insufficient. Any absolute URL passed to the vulnerable endpoint is honored.

Attack Vector

The attack requires network access and user interaction. An attacker crafts a URL pointing to the vulnerable WordPress site with a redirect parameter targeting a malicious domain. The victim receives the link through email, social media, or messaging platforms. Clicking the link triggers a redirect from the trusted site to the attacker's phishing infrastructure.

The vulnerability manifests when the plugin processes redirect parameters without validation. See the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-30885

Indicators of Compromise

Web server access logs showing requests to Bit Form endpoints containing external URLs in redirect parameters
HTTP 302 or 301 responses from the WordPress site pointing to unfamiliar external domains
Spike in outbound clicks from the WordPress domain to newly registered or low-reputation hosts
User reports of phishing pages reached via links that initially pointed to the trusted WordPress site

Detection Strategies

Inspect WordPress access logs for suspicious query parameters targeting bit-form plugin endpoints
Correlate referrer headers on phishing complaints with redirect activity from the WordPress host
Deploy web application firewall (WAF) rules that flag redirect parameters containing external URLs

Monitoring Recommendations

Track HTTP redirect responses issued by the WordPress site to domains outside the organization's allowlist
Monitor plugin version inventory across managed WordPress sites to identify hosts running bit-form at or below version 2.18.0
Alert on abnormal referral patterns where the WordPress domain serves as the entry point to external phishing pages

How to Mitigate CVE-2025-30885

Immediate Actions Required

Update the Bit Form plugin to a version later than 2.18.0 once a patched release is available from Bit Apps
Audit all WordPress installations for the presence of the bit-form plugin and confirm the installed version
Deactivate the plugin on sites where an updated version is not yet installed
Educate users about phishing links that appear to originate from trusted domains

Patch Information

Refer to the Patchstack advisory for the Bit Form plugin for the latest patch status. At the time of publication, versions through 2.18.0 are affected. Apply vendor updates as soon as a fixed release is available.

Workarounds

Deactivate and remove the bit-form plugin until a patched version is deployed
Configure a WAF rule to block requests to Bit Form endpoints containing absolute URLs in redirect parameters
Restrict redirect targets at the reverse proxy layer to the site's own domain
Add outbound URL filtering to warn users when clicking links that trigger cross-domain redirects from the WordPress host

bash

# Example WAF rule (ModSecurity) blocking external redirect targets on bit-form endpoints
SecRule REQUEST_URI "@contains bit-form" \
    "chain,phase:2,deny,status:403,id:1030885,msg:'Blocked potential open redirect (CVE-2025-30885)'"
    SecRule ARGS "@rx ^https?://(?!yourdomain\.com)" "t:none,t:urlDecodeUni"