Vulnerability · Published Jul 30, 2026 · Assigned by WPScan
CVE-2026-15054Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission
Low 3.7
In plain English
A low-severity missing authorization in Bit Form from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.2%top 83.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/ca7f4309-d546-4f6b-a973-cf47a455fc8f/ exploit, vdb-entry, technical-description