Executive brief
The Bit Form plugin for WordPress, which is used to create and manage website forms, contains a flaw that allows users to submit data to forms that have been deactivated or unpublished by the site owner. This means an unauthorized person could still trigger automated workflows, such as sending email notifications or saving entries to the database, even if the administrator intended for the form to be offline. This could lead to unwanted spam, resource consumption, or the bypass of intended business logic.
Technical details
The Bit Form plugin fails to perform an authorization check on the 'active' or 'published' status of a form within its AJAX submission handlers. Specifically, the 'bitforms_submit_form' and 'bitforms_trigger_workflow' actions in 'admin-ajax.php' do not validate if a form is currently enabled before processing a request. An unauthenticated attacker can first obtain necessary CSRF and identity tokens via the 'bitforms_onload_added_field_and_property' action and then submit data to any known form ID. This results in the creation of database entries and the execution of associated workflows, such as 'mailNotify', regardless of the form's administrative status. The issue is resolved in version 3.1.2, which adds a check returning a 403 error if the form is inactive.
Affected products
- Bit Apps Bit Form < 3.1.2
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Fixed in version 3.1.2
- 2026-07-30: advisory