What is the CVSS score of CVE-2026-13693?

CVE-2026-13693 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-13693?

Yes, a public proof-of-concept exploit is available for CVE-2026-13693. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-13693?

Yes, a patch is available for CVE-2026-13693. Update the affected software to the latest version immediately.

Bit Form CVE-2026-13693

EUVD-2026-46160 MEDIUM

Path Traversal (CWE-22)

2026-07-21 WPScan

GHSA-3cgv-fv99-x54w

WordPress Path Traversal Bit Form

5.9

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-accessible unauthenticated form submission; AC:H reflects the need to control or intercept the notification email to receive the traversed file; confidentiality impact is high given wp-config.php exposure; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:27 vuln.today

Patch available

Jul 21, 2026 - 08:02 EUVD

CVE Published

Jul 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 06:00 cve.org

MEDIUM 5.9

DescriptionCVE.org

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

AnalysisAI

Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal). The Bit Form plugin provides form-building functionality for WordPress sites and supports file-upload fields that can be attached to notification emails upon form submission. The plugin fails to sanitize or restrict the file path value submitted via the file-field before passing it to a file-read operation, meaning directory traversal sequences (e.g., ../../wp-config.php) can escape the expected upload directory. The affected product is identified by CPE cpe:2.3:a:unknown:bit_form:*:*:*:*:*:*:*:* covering all versions prior to 3.1.0. The underlying WordPress configuration file (wp-config.php) is a high-value target as it contains database host, username, password, authentication salts, and security keys in plaintext.

RemediationAI

Update the Bit Form WordPress plugin to version 3.1.0 or later, which contains the vendor-released patch addressing this path traversal. The fix can be applied through the WordPress admin dashboard under Plugins > Updates, or by downloading directly from the WordPress plugin repository. The WPScan advisory at https://wpscan.com/vulnerability/3a01cd45-1d36-4e36-aca8-947353c474a7/ and VulDB at https://vuldb.com/vuln/380815 provide additional context. If immediate upgrade is not possible, a compensating control is to disable any Bit Form forms that include file-upload fields until patching is complete - this removes the vulnerable code path entirely with no functionality loss to non-file-upload forms. Alternatively, restrict public access to form endpoints via a WAF rule or .htaccess ACL while the patch is deployed; note this may disrupt legitimate form submissions. Reviewing web server logs for traversal sequences (e.g., ../) in form submissions can help identify whether exploitation has already been attempted.