CVE-2026-15054

Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

We have discovered 1,066 live websites that are affected by CVE-2026-15054.

Run a Free Instant Scan



Affected Software

Product  Bit Form
Category Wordpress Plugins
Vulnerable Domains1,066 live websites (100% of Bit Form install base)
Vulnerable Versions
  • from 0 through 3.1.2
Vulnerable Versions Count57 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Jul 30, 2026
  • Updated - Jul 30, 2026

Credits

  • Charles Vosburgh (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-15054
United States330 websites


Germany117 websites
GB66 websites
Australia59 websites
France57 websites
Netherlands45 websites
India39 websites
Canada37 websites
Italy37 websites
Russia24 websites

Website Distribution by TLD

Number of websites using CVE-2026-15054
.com437 websites
.de74 websites
.com.au66 websites
.org54 websites
.co.uk38 websites
.nl36 websites
.fr33 websites
.net29 websites
.it26 websites
.ru22 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15054

Top websites that are affected by CVE-2026-15054. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****************.com Bulgaria***,***
*********.tv United States***,***
*************.***.au France***,***
*************.com United States***,***
*********.**.uk GB***,***
****.org United States***,***
****.be Belgium***,***
******.me Singapore***,***
**********.com United States*,***,***
******.com Spain*,***,***
See full domain list

FAQ

CVE-2026-15054 is Missing Authorization in Bit Form
A total of 1,066 websites have been identified as vulnerable to CVE-2026-15054, based on global website indexing conducted by WebTechSurvey.
The Bit Form is affected by the CVE-2026-15054 vulnerability.
Bit Form versions up to 3.1.2 are vulnerable to CVE-2026-15054.
CVE-2026-15054 is resolved in version 3.1.2 of Bit Form.