What the vulnerability does
01Description
The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification fails and the user is logged in. This makes it possible for unauthenticated attackers to replay form workflow executions and trigger all configured integrations including webhooks, email notifications, CRM integrations, and automation platforms via the bitforms_trigger_workflow AJAX action granted they can obtain the entry ID and log IDs from a legitimate form submission response.
Explanation of Vulnerability in Simple Terms
02Summary
Bit Form versions up to 2.21.6 lack proper authorization checks, allowing unauthenticated attackers to modify form data and settings. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 2.21.6 to restore access controls.
What an attacker can do
03Attacker Capabilities
Modify form data and settings without logging in.
Potential impact on your site
04Site Impact
Forms and their data can be altered by anyone, potentially disrupting submissions or exposing collected information.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 7, 2026
CVE published
April 8, 2026
Record updated
