5.9
Medium
CVE-2026-13693 The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading…
Description
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Bit Form 3.1 | earliest → < 3.1.0 | 3.1.0 |
Other CVEs of Bit Form
The 6 CVEs of Bit Form →
CVE-2026-16573
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing…
7.5
High
CVE-2025-15669
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before…
4.8
Medium
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public…
3.7
Low
CVE-2026-13694
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated…
6.5
Medium