CVE-2026-13693: Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Bit Form pluginto a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Update the Bit Form plugin so that the form file-field value is restricted to a safe path before the plugin reads the file and attaches it to a notification email.
WordPress Bit Form plugin form file-field path restriction = restrict to a safe path before reading
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13693?
The severity of CVE-2026-13693 is medium with a CVSS score of 5.9.
How do I fix CVE-2026-13693?
To fix CVE-2026-13693, update the Bit Form WordPress plugin to version 3.1.0 or later.
What type of vulnerability is CVE-2026-13693?
CVE-2026-13693 is a path traversal vulnerability that allows unauthorized file access.
Who is affected by CVE-2026-13693?
Users of the Bit Form WordPress plugin prior to version 3.1.0 are affected by CVE-2026-13693.
What can attackers do with CVE-2026-13693?
Attackers can exploit CVE-2026-13693 to read arbitrary files from the server, including sensitive files like the WordPress configuration file.