The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Bit Form Plugin | — | Update bit-form plugin to version 3.1.2, or a newer patched version | Aug 10, 2026 | Jul 30, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub