Bit Form CVE-2026-15054

Exploitation requires no authentication (PR:N per CVSS vector) and no user interaction, but the CVSS AC:H rating reflects a concrete prerequisite: the attacker must discover or guess a valid form ID belonging to a form that is specifically in a deactivated or unpublished state. If all of a site's Bit Form forms are currently active/published, there is no exploitable condition - the vulnerability only manifests for forms the administrator has deactivated. Additionally, meaningful impact (workflow execution such as email notifications) only occurs if the targeted deactivated form has backend workflows configured; a deactivated form with no workflows produces only a database entry with no external side-effects. Exploitation is therefore limited by form-ID discoverability, the existence of deactivated forms, and the presence of configured workflows on those forms.

The official CVSS 3.1 score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained real-world risk. The AC:H designation is key: an attacker must first enumerate or otherwise discover the internal identifier of a form that happens to be in a deactivated state, which reduces opportunistic exploitation potential. EPSS at 0.15% (5th percentile) corroborates that exploitation probability is very low despite the existence of public POC code - the gap between POC availability and realized exploitation is large here, consistent with the high complexity and narrow impact. There is no CISA KEV listing, no confidentiality impact, and no availability impact; the worst realistic outcome is triggering unwanted email floods or populating a deactivated form's entry database. This is not a high-priority remediation for most organizations, but sites using Bit Form for sensitive intake workflows (e.g., lead capture feeding a CRM) may see business process disruption and data integrity concerns from phantom submissions. The POC's public availability does modestly elevate urgency for patching relative to a pure CVSS read.

An attacker enumerates a target WordPress site's Bit Form submission endpoint (via source-code inspection or the public POC) and identifies the form ID of a deactivated form - perhaps a seasonal campaign form the site owner disabled. The attacker sends crafted POST requests directly to the form-submission handler referencing that ID, successfully storing entries in the database and triggering the form's configured email notification workflow, resulting in repeated unsolicited emails to the site's admin or connected third-party services. A publicly available exploit exists per WPScan, lowering the technical bar, though the attacker still needs to identify valid deactivated form IDs.