CVE-2026-15054
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on public submission handlers. Unauthenticated users can submit entries to deactivated or unpublished forms and trigger configured workflows like email notifications.
Risk Assessment
The organization may receive unwanted submissions and notifications from inactive forms, potentially causing confusion or data leakage.
Recommendation
Update the Bit Form plugin to version 3.1.2 or later.
Other vulnerabilities in Bit Form WordPress plugin
See all- CVE-2026-16810Medium
The Bit Form plugin for WordPress, up to and including version 3.2.0, is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.
- CVE-2026-13693Medium
The Bit Form WordPress plugin before version 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email. This allows unauthenticated attackers to read arbitrary server files, such as the WordPress configuration file.
Original NVD description (English source)
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS