The Bit Form – Contact Form Plugin for WordPress is vulnerable to unauthorized workflow execution caused by a missing authorization check in the triggerWorkFlow logic. The nonce verification only blocks requests when both the nonce fails and the user is logged in, meaning unauthenticated users can supply a valid nonce and replay a previously recorded workflow. Attackers can trigger all configured integrations—including webhooks, email notifications, CRM integrations, and automation platforms—via the bitforms_trigger_workflow AJAX action once they obtain an entry ID and log IDs from a legitimate form submission. This flaw enables remote execution of arbitrary integration actions without authentication, posing a consent abuse and potential data leakage risk.

WordPress sites running the Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder plugin version 2.21.6 or earlier are affected. The vulnerability exists in all releases up to and including 2.21.6.

The CVSS score of 6.5 indicates medium severity; however, the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploitation. Attackers would need to obtain a legitimate entry ID and log ID, which can be gleaned from a normal form submission, and then send a crafted AJAX request to the bitforms_trigger_workflow action. Because the flaw relies on missing authorization rather than insecure input or remote code execution, the risk is moderate but still significant for sites with active integrations.