CVE-2026-15054

The CVE affects the Bit Form WordPress plugin prior to version 3.1.2. The root cause is that form submission handlers do not enforce a form’s active/published status, allowing unauthenticated users to submit entries to, and trigger configured workflows (e.g., email notifications) for forms that t...

EUVD-2026-50989

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...