PT-2026-1572 · WordPress · Bit Form – Contact Form Plugin

Andrea Bocchetti · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-14901

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bit Form – Contact Form Plugin versions prior to 2.21.7

Description The Bit Form – Contact Form Plugin for WordPress has a flaw allowing unauthorized workflow execution. The triggerWorkFlow function lacks proper authorization, specifically in its nonce verification. The security check only prevents requests when both nonce verification fails and the user is logged in. This allows unauthenticated attackers to replay form workflow executions and activate configured integrations like webhooks, email notifications, CRM integrations, and automation platforms. Attackers need to obtain the entry ID and log IDs from a legitimate form submission response to exploit this issue via the bitforms trigger workflow AJAX action.

Recommendations Update to version 2.21.7 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14901

Produtos afetados

Bit Form – Contact Form Plugin

Referências · 6

• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L30 · Nota
• https://twitter.com/CVEnew/status/2008795335791984955 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14901 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429172%40bit-form%2Ftrunk&old=3420966%40bit-form%2Ftrunk&sfp_email=&sfph_mail=#file827 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L146 · Nota