CVE-2026-13694— Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13694
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Bit Form 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Bit Form是WordPress基金会的一款多功能的表单构建插件。 WordPress Bit Form 3.1.0之前版本存在授权问题漏洞，该漏洞源于对工作流触发令牌验证不当，导致未认证攻击者能够重新触发表单配置的工作流动作，如通知邮件和集成。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-13694
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13694
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13694 (1)
- 🔗 Bit Form < 3.1.0 – Unauthenticated Workflow Trigger via Authentication Bypass | CVE 2026-13694 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-21 · 7 CVEs total
| CVE-2026-14184 | Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDO | |
| CVE-2026-14185 | WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update | |
| CVE-2026-14183 | Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR | |
| CVE-2026-8082 | Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection | |
| CVE-2026-11767 | CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form | |
| CVE-2026-13693 | Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal |
IV. Related Vulnerabilities
Same product: Bit Form
- CVE-2026-13693
Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via P - CVE-2026-25418
WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnera - CVE-2025-30885
WordPress Bit Form plugin <= 2.18.0 - Open Redirection vulne - CVE-2024-47335
WordPress Bit Form plugin <= 2.13.11 - SQL Injection vulnera - CVE-2024-47301
WordPress Bit Form plugin <= 2.13.10 - Cross Site Scripting
Same vendor: Unknown
- CVE-2026-14603
WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and - CVE-2026-12688
ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and F - CVE-2026-12689
ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Messa - CVE-2026-12690
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tamperin - CVE-2026-12981
CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Passw
V. Comments for CVE-2026-13694
No comments yet