CVE-2026-15054
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on public submission handlers. Unauthenticated users can submit entries to deactivated or unpublished forms and trigger configured workflows like email notifications.
Risk Assessment
The organization may receive unwanted submissions and notifications from inactive forms, potentially causing confusion or data leakage.
Recommendation
Update the Bit Form plugin to version 3.1.2 or later.
Original NVD description (English source)
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.