5.9
Moyenne
CVE-2026-13693 The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading…
Description
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Bit Form 3.1 | premières → < 3.1.0 | 3.1.0 |
Autres CVE de Bit Form
Les 6 CVE de Bit Form →
CVE-2026-16573
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing…
7.5
Élevée
CVE-2025-15669
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before…
4.8
Moyenne
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public…
3.7
Faible
CVE-2026-13694
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated…
6.5
Moyenne