Executive brief
The Bit Form plugin for WordPress, which is used to create and manage website forms, contains a security flaw in how it handles automated workflows. An attacker can bypass security checks to repeatedly trigger form actions, such as sending notification emails or syncing data with external integrations. This could lead to email spamming, exhaustion of third-party API limits, or disruption of business operations.
Technical details
The vulnerability is an authentication bypass within the workflow-trigger mechanism of the Bit Form plugin. When a workflow's 1-hour trigger transient expires, the plugin fails to properly validate the provided trigger token. An unauthenticated attacker can exploit this by sending a crafted POST request to the 'bitforms_trigger_workflow' AJAX action with a non-empty, arbitrary token. If the attacker possesses a valid workflow log ID and entry ID, they can re-execute configured workflow actions such as email notifications and third-party integrations. This issue is fixed in version 3.1.0.
Affected products
- Bit Apps Bit Form < 3.1.0
Timeline
- 2026-06-30: disclosed: Publicly published by WPScan
- 2026-07-21: advisory: NVD published date