CVE-2026-13694 — Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers t…
Published: 2026-07-21 · CVSS: 6.5 · CVSS 3.1
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7