CVE-2026-15054: Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Bit Form pluginto a version that resolves this vulnerability.Fixed in 3.1.2 - Configuration
Upgrade to Bit Form 3.1.2 or later so the plugin enforces a form's active/published status on its public form-submission handlers, preventing unauthenticated submissions (and workflow firing like email notifications) for deactivated or unpublished forms.
Bit Form (WordPress plugin) Enforce active/published status on public form submission handlers = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15054?
CVE-2026-15054 has a severity rating of low, with a CVSS score of 3.7.
How do I fix CVE-2026-15054?
To fix CVE-2026-15054, update the Bit Form WordPress plugin to version 3.1.2 or later.
What type of vulnerability is CVE-2026-15054?
CVE-2026-15054 is an unauthenticated inactive form submission vulnerability affecting the Bit Form WordPress plugin.
What are the implications of CVE-2026-15054?
CVE-2026-15054 allows unauthenticated users to submit forms that have been deactivated or unpublished, potentially triggering workflows.
Which software is impacted by CVE-2026-15054?
CVE-2026-15054 affects the Bit Form WordPress plugin, specifically versions before 3.1.2.