What is the CVSS score of CVE-2026-13694?

CVE-2026-13694 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-13694?

Yes, a public proof-of-concept exploit is available for CVE-2026-13694. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-13694?

Yes, a patch is available for CVE-2026-13694. Update the affected software to the latest version immediately.

Bit Form CVE-2026-13694

EUVD-2026-46161 MEDIUM

Missing Authorization (CWE-862)

2026-07-21 WPScan

GHSA-xfxr-j75f-v7p4

Authentication Bypass WordPress Bit Form

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable replay with no auth or interaction required; impact confined to unauthorized workflow re-execution with no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:29 vuln.today

CVSS changed

Jul 21, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 21, 2026 - 08:02 EUVD

CVE Published

Jul 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.

AnalysisAI

Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.

Technical ContextAI

Bit Form is a WordPress form-builder plugin that uses WordPress transients - a native caching API that stores ephemeral key-value pairs with configurable TTLs in the wp_options table - to issue and validate workflow-trigger tokens. These tokens gate execution of post-submission workflow actions (email notifications, webhook calls, third-party integrations). CWE-862 (Missing Authorization) is the root cause: the plugin's token validation logic does not properly enforce a rejection path once the associated transient has expired, meaning a previously valid token can be replayed indefinitely without authorization. CPE cpe:2.3:a:unknown:bit_form:*:*:*:*:*:*:*:* covers all versions of the plugin up to but not including 3.1.0. The 'unknown' vendor identifier in the CPE string reflects NVD/EUVD not yet resolving the canonical vendor slug, which is typical for smaller WordPress plugin authors.

RemediationAI

The primary fix is to upgrade the Bit Form WordPress plugin to version 3.1.0 or later via the WordPress admin dashboard or wp-cli (wp plugin update bit-form). The vendor-released patch is confirmed per WPScan advisory https://wpscan.com/vulnerability/3ed474fc-8363-4068-9a12-3d63be4a81bd/. If immediate upgrade is not possible, a compensating control is to disable or restrict the specific workflow action types most sensitive to replay abuse - particularly outbound webhook or email notification actions - through the Bit Form workflow configuration panel, accepting the trade-off of losing automated notifications until the patch is applied. Sites should also audit form submission logs for anomalous replay patterns (repeated workflow triggers for the same or similar token values) to identify retrospective abuse. No additional firewall rule or WAF signature can reliably block this at the network layer since the replayed request is structurally identical to a legitimate one.