Is CVE-2026-13694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13694 being exploited in the wild.

How severe is CVE-2026-13694?

Informational severity, with a CVSS score of 6.5, published 21 July 2026.

Is there a fix for CVE-2026-13694?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13694 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13694?

Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13694: Bit Apps Bit Form authentication bypass in workflow trigger

CVE-2026-13694 · Severity: info · CVSS 6.5 · Published 2026-07-21

The Bit Form plugin for WordPress, which is used to create and manage website forms, contains a security flaw in how it handles automated workflows. An attacker can bypass security checks to repeatedly trigger form actions, such as sending notification emails or syncing data with external integrations. This could lead to email spamming, exhaustion of third-party API limits, or disruption of business operations.

Technologies: Bit Apps Bit Form. Vendors: Bit Apps.

Quick answers

Is CVE-2026-13694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13694 being exploited in the wild.
How severe is CVE-2026-13694?: Informational severity, with a CVSS score of 6.5, published 21 July 2026.
Which products and versions are affected?: Bit Apps Bit Form < 3.1.0.
Is there a fix for CVE-2026-13694?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13694 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13694?: Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass within the workflow-trigger mechanism of the Bit Form plugin. When a workflow's 1-hour trigger transient expires, the plugin fails to properly validate the provided trigger token. An unauthenticated attacker can exploit this by sending a crafted POST request to the 'bitforms_trigger_workflow' AJAX action with a non-empty, arbitrary token. If the attacker possesses a valid workflow log ID and entry ID, they can re-execute configured workflow actions such as email notifications and third-party integrations. This issue is fixed in version 3.1.0.

Affected products

Bit Apps Bit Form < 3.1.0

Timeline

2026-06-30: disclosed: Publicly published by WPScan
2026-07-21: advisory: NVD published date

References

https://wpscan.com/vulnerability/3ed474fc-8363-4068-9a12-3d63be4a81bd/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.