3.7
Faible
CVE-2026-15054 The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public…
Description
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Bit Form 3.1 | premières → < 3.1.2 | 3.1.2 |
Autres CVE de Bit Form
Les 6 CVE de Bit Form →
CVE-2026-16573
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing…
7.5
Élevée
CVE-2025-15669
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before…
4.8
Moyenne
CVE-2026-13694
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated…
6.5
Moyenne
CVE-2026-13693
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading…
5.9
Moyenne