CVE-2026-13694
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Risk Assessment
The organization risks unauthorized sending of emails and execution of integrations, potentially leading to user spam or uncontrolled actions in external systems.
Recommendation
Update the Bit Form plugin to version 3.1.0 or later, which includes the token validation fix.
Other vulnerabilities in Bit Form
See all- CVE-2026-14372High
The Bit Form plugin for WordPress up to version 3.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.
- CVE-2026-16573High
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when viewed, leading to Stored Cross-Site Scripting.
- CVE-2025-15669Medium
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
Original NVD description (English source)
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.