EUVD-2026-50989
GHSA-phfq-m343-hfqp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network vector with no auth; AC:H because attacker must discover a deactivated form ID; only low integrity impact from phantom submissions with no confidentiality or availability breach.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
AnalysisAI
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N per CVSS vector) and no user interaction, but the CVSS AC:H rating reflects a concrete prerequisite: the attacker must discover or guess a valid form ID belonging to a form that is specifically in a deactivated or unpublished state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates a target WordPress site's Bit Form submission endpoint (via source-code inspection or the public POC) and identifies the form ID of a deactivated form - perhaps a seasonal campaign form the site owner disabled. The attacker sends crafted POST requests directly to the form-submission handler referencing that ID, successfully storing entries in the database and triggering the form's configured email notification workflow, resulting in repeated unsolicited emails to the site's admin or connected third-party services. … |
| Remediation | The primary fix is to upgrade the Bit Form WordPress plugin to version 3.1.2 or later, which introduces server-side enforcement of form active/published status on all public submission handlers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload cr
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro al
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Rat
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.6.4. Rated medium seve
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Co
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form buil
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today