EUVD-2026-46161
GHSA-xfxr-j75f-v7p4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable replay with no auth or interaction required; impact confined to unauthorized workflow re-execution with no confidentiality loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
AnalysisAI
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
Technical ContextAI
Bit Form is a WordPress form-builder plugin that uses WordPress transients - a native caching API that stores ephemeral key-value pairs with configurable TTLs in the wp_options table - to issue and validate workflow-trigger tokens. These tokens gate execution of post-submission workflow actions (email notifications, webhook calls, third-party integrations). CWE-862 (Missing Authorization) is the root cause: the plugin's token validation logic does not properly enforce a rejection path once the associated transient has expired, meaning a previously valid token can be replayed indefinitely without authorization. CPE cpe:2.3:a:unknown:bit_form:*:*:*:*:*:*:*:* covers all versions of the plugin up to but not including 3.1.0. The 'unknown' vendor identifier in the CPE string reflects NVD/EUVD not yet resolving the canonical vendor slug, which is typical for smaller WordPress plugin authors.
RemediationAI
The primary fix is to upgrade the Bit Form WordPress plugin to version 3.1.0 or later via the WordPress admin dashboard or wp-cli (wp plugin update bit-form). The vendor-released patch is confirmed per WPScan advisory https://wpscan.com/vulnerability/3ed474fc-8363-4068-9a12-3d63be4a81bd/. If immediate upgrade is not possible, a compensating control is to disable or restrict the specific workflow action types most sensitive to replay abuse - particularly outbound webhook or email notification actions - through the Bit Form workflow configuration panel, accepting the trade-off of losing automated notifications until the patch is applied. Sites should also audit form submission logs for anomalous replay patterns (repeated workflow triggers for the same or similar token values) to identify retrospective abuse. No additional firewall rule or WAF signature can reliably block this at the network layer since the replayed request is structurally identical to a legitimate one.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload cr
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro al
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Rat
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handler
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.6.4. Rated medium seve
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Co
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form buil
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today