The vulnerability lies in Bit Form WordPress plugin versions before 3.1.0, where the plugin does not validate its workflow‑trigger token after the associated transient expires. An attacker can exploit this flaw to re‑trigger a form’s configured workflows, such as sending notification emails or calling third‑party integrations, without any authentication. This behavior results only in the unintended execution of the plugin’s workflow actions and does not grant direct code execution or broader system compromise. The flaw corresponds to CWE-862, Missing Authorization.

WordPress installations running the Bit Form plugin at any version lower than 3.1.0. The affected component is the workflow‑trigger mechanism that validates tokens against transient expiration.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a direct HTTP request to the plugin’s workflow endpoint, requiring no authenticated session. An attacker only needs the public URL and an expired token, meaning that any publicly accessible site with this plugin is potentially vulnerable. The vulnerability is identified as CWE-862, Missing Authorization.