CVE-2026-15054 — Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit en…
Published: 2026-07-30 · CVSS: 3.7 · CVSS 3.1
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7