Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-13693: Bit Form WordPress plugin allows attackers to read server files
CVE-2026-13693 · published 3 months ago
Summary
The Bit Form WordPress plugin for websites before version 3.1.0 has a security flaw that lets hackers read sensitive files on the server, including the WordPress configuration. This could allow them to access and steal confidential information. To protect your website, update the Bit Form plugin to version 3.1.0 or later.
What to do
- Update unknown bit form to version 3.1.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | bit form | < 3.1.0 |
Original advisory text
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attac...
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.9
Medium
Type
CWE-22Path Traversal
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Track software like this
Free during beta