low3.7
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated u…
Impact
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
Affected products
| Product | Affected versions |
|---|---|
| Bit Form WordPress Plugin | before 3.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.