CVE-2026-15054

Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

Affected

Bit Form

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 15th percentile

Published

2026-07-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ca7f4309-d546-4f6b-a973-cf47a455fc8f/

References

• CVE Record
• NVD entry