# CVE-2026-13693: Bit Apps Bit Form path traversal in file-field attachments

Source: https://junglewise.ai/threats/cve-2026-13693-bit-apps-bit-form-path-traversal-in-file-field-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-13693 · Severity: info · CVSS 6.8 · Published 2026-07-21

Bit Form is a WordPress plugin used to create and manage contact forms. A security flaw allows unauthenticated attackers to trick the system into sending them sensitive server files, such as the WordPress configuration file containing database credentials. This could lead to a full site takeover or unauthorized access to customer data.

Technologies: [Bit Apps Bit Form](https://junglewise.ai/threats/technologies/bit-form). Vendors: [Bit Apps](https://junglewise.ai/threats/vendors/bit-apps).

## Quick answers

**Is CVE-2026-13693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13693 being exploited in the wild.

**How severe is CVE-2026-13693?** Informational severity, with a CVSS score of 6.8, published 21 July 2026.

**Which products and versions are affected?** Bit Apps Bit Form < 3.1.0.

**Is there a fix for CVE-2026-13693?** A patch was published on 2026-06-30: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13693 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13693?** Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the Bit Form plugin for WordPress prior to version 3.1.0. The plugin fails to validate or sanitize the file-field value in form submissions before using it as a file path for email attachments. An unauthenticated attacker can provide a traversal string (e.g., ../../../wp-config.php) in a file-upload field. If the form is configured with an autoresponder or notification email that includes the file field as an attachment, the plugin will read the specified file from the server and email it to the attacker-controlled address. This requires a form to be configured with a file field and an active email notification workflow.

## Affected products

- Bit Apps Bit Form < 3.1.0

## Timeline

- 2026-06-30: disclosed: Publicly published by WPScan
- 2026-07-21: advisory: NVD published date
- 2026-06-30: patched: Fixed in version 3.1.0

## References

- [https://wpscan.com/vulnerability/3a01cd45-1d36-4e36-aca8-947353c474a7/](https://wpscan.com/vulnerability/3a01cd45-1d36-4e36-aca8-947353c474a7/)

## Related threats

- [Bit Apps Bit Form stored XSS in Conversational Form Progress Label](https://junglewise.ai/threats/cve-2025-15669-bit-apps-bit-form-stored-xss-in-conversational-form-progress)
- [Bit Apps Bit Form missing authorization for inactive form submission](https://junglewise.ai/threats/cve-2026-15054-bit-apps-bit-form-missing-authorization-for-inactive-form)
- [Bit Apps Bit Form authentication bypass in workflow trigger](https://junglewise.ai/threats/cve-2026-13694-bit-apps-bit-form-authentication-bypass-in-workflow-trigger)
- [Bit Form WordPress Plugin arbitrary file deletion in deleteFiles](https://junglewise.ai/threats/cve-2026-14372-bit-form-wordpress-plugin-arbitrary-file-deletion-in-deletefiles)
- [Bit Apps BitForm Stored XSS in bitform shortcode](https://junglewise.ai/threats/cve-2026-8891-bit-apps-bitform-stored-xss-in-bitform-shortcode)