Quick answers
- Is CVE-2026-15054 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15054 being exploited in the wild.
- How severe is CVE-2026-15054?
- Informational severity, with a CVSS score of 3.7, published 30 July 2026.
- Which products and versions are affected?
- Bit Apps Bit Form < 3.1.2.
- Is there a fix for CVE-2026-15054?
- A patch was published on 2026-07-09: Fixed in version 3.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-15054 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-15054?
- Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Bit Form plugin fails to perform an authorization check on the 'active' or 'published' status of a form within its AJAX submission handlers. Specifically, the 'bitforms_submit_form' and 'bitforms_trigger_workflow' actions in 'admin-ajax.php' do not validate if a form is currently enabled before processing a request. An unauthenticated attacker can first obtain necessary CSRF and identity tokens via the 'bitforms_onload_added_field_and_property' action and then submit data to any known form ID. This results in the creation of database entries and the execution of associated workflows, such as 'mailNotify', regardless of the form's administrative status. The issue is resolved in version 3.1.2, which adds a check returning a 403 error if the form is inactive.
Affected products
- Bit Apps Bit Form < 3.1.2
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Fixed in version 3.1.2
- 2026-07-30: advisory