Quick answers
- Is CVE-2026-13693 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13693 being exploited in the wild.
- How severe is CVE-2026-13693?
- Informational severity, with a CVSS score of 6.8, published 21 July 2026.
- Which products and versions are affected?
- Bit Apps Bit Form < 3.1.0.
- Is there a fix for CVE-2026-13693?
- A patch was published on 2026-06-30: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13693 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13693?
- Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the Bit Form plugin for WordPress prior to version 3.1.0. The plugin fails to validate or sanitize the file-field value in form submissions before using it as a file path for email attachments. An unauthenticated attacker can provide a traversal string (e.g., ../../../wp-config.php) in a file-upload field. If the form is configured with an autoresponder or notification email that includes the file field as an attachment, the plugin will read the specified file from the server and email it to the attacker-controlled address. This requires a form to be configured with a file field and an active email notification workflow.
Affected products
- Bit Apps Bit Form < 3.1.0
Timeline
- 2026-06-30: disclosed: Publicly published by WPScan
- 2026-07-21: advisory: NVD published date
- 2026-06-30: patched: Fixed in version 3.1.0