Medium severity6.5NVD Advisory· Published Jul 21, 2026· Updated Jul 21, 2026

CVE-2026-13694

Description

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.

Affected products

WordPress/Bit Formllm-fuzzy
Range: <3.1.0
Package: https://wordpress.org/plugins/bit-form

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/3ed474fc-8363-4068-9a12-3d63be4a81bd/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000