CVE-2026-15054

3.7 lowEPSS 0.2%

Low (3.7). EPSS 0.2% chance of exploitation in the next 30 days.

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-07-30
Modified: 2026-07-30
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/ca7f4309-d546-4f6b-a973-cf47a455fc8f/

Check your stack JSON