PT-2026-1572 · WordPress · Bit Form – Contact Form Plugin

Andrea Bocchetti · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-14901

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bit Form – Contact Form Plugin versions prior to 2.21.7

Description The Bit Form – Contact Form Plugin for WordPress has a flaw allowing unauthorized workflow execution. The triggerWorkFlow function lacks proper authorization, specifically in its nonce verification. The security check only prevents requests when both nonce verification fails and the user is logged in. This allows unauthenticated attackers to replay form workflow executions and activate configured integrations like webhooks, email notifications, CRM integrations, and automation platforms. Attackers need to obtain the entry ID and log IDs from a legitimate form submission response to exploit this issue via the bitforms trigger workflow AJAX action.

Recommendations Update to version 2.21.7 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14901

Affected Products

Bit Form – Contact Form Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14901 · Security Note
• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L30 · Note
• https://twitter.com/CVEnew/status/2008795335791984955 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429172%40bit-form%2Ftrunk&old=3420966%40bit-form%2Ftrunk&sfp_email=&sfph_mail=#file827 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=cve · Note
• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L146 · Note