Bit Form CVE-2026-13693

The targeted WordPress site must have the Bit Form plugin installed in a version prior to 3.1.0. A form containing a file-upload field must be actively deployed and publicly accessible (no authentication required to submit). The form must be configured to send notification emails that include the file attachment. The critical limiting factor - and the source of AC:H - is that the attacker must control or intercept the notification email recipient address in order to receive the traversed file as an attachment; a form that only emails the site administrator with no copy to the submitter cannot be exploited without an additional step. No special OS configuration, server role, or network position is required beyond the ability to reach and submit the public form.

CVSS scores this at 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The AC:H rating is the critical moderating factor: successful exploitation requires the attacker to satisfy a complexity condition, most likely controlling or intercepting the notification email destination to actually receive the attached file - a non-trivial step. This aligns with SSVC Automatable:no, confirming the attack cannot be scripted at scale without additional preconditions. Technical Impact is rated 'partial' by SSVC, though the potential disclosure of wp-config.php credentials could enable full site compromise as a secondary step. EPSS at 0.16% (6th percentile) is very low, suggesting the security research community does not assess widespread exploitation as likely in the near term. A public POC exists (WPScan), which slightly elevates urgency over a zero-POC finding. No CISA KEV listing confirms no confirmed in-the-wild exploitation at time of analysis. Overall: moderate urgency - patch promptly but the AC:H and Automatable:no signals mean this is not a fire-and-forget mass-exploitation scenario.

An attacker identifies a WordPress site running Bit Form with a form that includes a file-field and sends notification emails. The attacker submits the form, supplying a path traversal string (such as ../../wp-config.php) as the file-field value, and manipulates the email destination - either by exploiting a form configuration that copies submissions to the submitter, or by other means - causing the plugin to read and attach the WordPress configuration file to the outbound notification email. A public POC is available from WPScan, lowering the skill bar for this step, though the email interception component introduces meaningful complexity.