CVE-2026-15054

LowCVSS 3.7/10Last modified Jul 30, 2026

Description

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Bit Form	< 3.1.2

References

https://wpscan.com/vulnerability/ca7f4309-d546-4f6b-a973-cf47a455fc8f/

Timeline

Published: Jul 30, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-150558.2In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle CVE-2026-150566.5The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory CVE-2026-150577.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocatio CVE-2026-150583.1Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to d CVE-2026-150595.5Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.CVE-2026-15067.2A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC CVE-2026-150604.7When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, CVE-2026-150618.2IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path t CVE-2026-150629.6SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-CVE-2026-150636.3A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gor CVE-2026-150648.7IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper han CVE-2026-150659.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of inter