The Bit Form WordPress plugin before version 3.1.2 does not enforce a form’s active or published status on its public submission handlers, permitting unauthenticated users to submit entries to forms that the site owner has deactivated or unpublished. This can trigger any configured workflow, such as sending email notifications, without the site owner’s permission. The weakness is a missing authorization check, identified as CWE-862.

All Bit Form WordPress plugin installations running a version earlier than 3.1.2 are affected. The vulnerability applies to every form instance that has been deactivated or unpublished but still exposes the form-submission endpoint.

The CVSS score of 3.7 indicates moderate impact with limited scope. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely via publicly accessible form URLs; an attacker can craft a POST request to a deactivated form and cause the plugin to fire its workflows. No authentication is required, and the exploit would primarily result in unwanted email notifications or other workflow actions.