Bit Form CVE-2026-13694

Exploitation requires the attacker to possess or discover a previously issued workflow-trigger token for a target form - obtainable from a prior legitimate or attacker-controlled form submission, from intercepted network traffic, or potentially from server logs or referrer headers if tokens appear in URLs. The associated WordPress transient for the token must have expired for the vulnerable code path to be reached. The target form must have at least one workflow action configured (email notification, integration, webhook, etc.) - a form with no workflow actions produces no meaningful impact. No authentication is required once the token is in hand. Exploitation is limited to replaying existing workflow actions; it does not grant code execution, file access, or data exfiltration. The attack surface is bounded to sites running Bit Form with active workflow configurations.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) yields a 6.5 Medium score and is internally consistent with the description: the attack is network-reachable, requires no authentication, and no user interaction. Practical impact is limited to integrity and availability at the Low tier - no confidentiality loss, no code execution. No EPSS score is available in the supplied data, so exploitation probability cannot be quantified numerically; however, the presence of a public PoC from WPScan (a widely-followed vulnerability tracker) materially lowers the bar for abuse. The vulnerability is not listed in CISA KEV, suggesting no confirmed mass exploitation at analysis time, though that status can change. The highest real-world risk is operational: abusive replay of notification emails (causing deliverability harm) or triggering paid third-party integration API calls at scale (causing cost amplification or rate-limit exhaustion). Sites with sensitive workflow actions - lead submission webhooks, Slack alerts, payment integrations - face disproportionate impact relative to the Medium CVSS score.

An attacker who previously submitted a form (or observed a form submission token in transit via a shared or logged URL) waits for the associated WordPress transient to expire, then replays the original workflow-trigger request to the plugin endpoint. Because the expired-transient path lacks proper authorization rejection, the plugin executes all configured workflow actions - sending notification emails to site administrators, firing CRM webhooks, or posting Slack messages - as if a legitimate submission occurred. A public PoC is available via WPScan, making this a low-skill, reproducible attack.