CVE-2026-15054

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

CVSS v3.1

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2026-07-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ca7f4309-d546-4f6b-a973-cf47a455fc8f/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1505
• CVE-2026-1506
• CVE-2026-15049
• CVE-2026-1508
• CVE-2026-15048
• CVE-2026-1509