CVE-2026-13693 — Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing u…
Published: 2026-07-21 · CVSS: 5.9 · CVSS 3.1
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7