CVE-2026-13693
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Bit Form WordPress plugin before version 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email. This allows unauthenticated attackers to read arbitrary server files, such as the WordPress configuration file.
Risk Assessment
Attackers can access sensitive configuration files, including database credentials, leading to full compromise of the WordPress site.
Recommendation
Update the Bit Form plugin to version 3.1.0 or later, which includes a fix that restricts the file path to a safe location.
Other vulnerabilities in Bit Form WordPress plugin
See all- CVE-2026-16810Medium
The Bit Form plugin for WordPress, up to and including version 3.2.0, is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.
- CVE-2026-15054Low
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on public submission handlers. Unauthenticated users can submit entries to deactivated or unpublished forms and trigger configured workflows like email notifications.
Original NVD description (English source)
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.