CVE-2026-13693
Deferred Deferred - Pending Action

Arbitrary File Read in Bit Form WordPress Plugin

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: WPScan

Description
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-08-10
AI Q&A
2026-07-21
EPSS Evaluated
2026-08-09
NVD
CVE-2026-13693
EUVD
EUVD-2026-46160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bit_form wordpress_plugin to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Bit Form WordPress plugin before version 3.1.0. It allows unauthenticated attackers to read arbitrary server files through a path traversal attack. The issue occurs because the plugin does not properly restrict file paths when reading uploaded files and attaching them to notification emails.

Detection Guidance

Check if the Bit Form WordPress plugin version is below 3.1.0. Look for forms with file-upload fields and mail notifications configured to attach uploaded files. Test by submitting a form with a traversal path like ../../../../../../wp-config.php to see if it returns file contents.

Impact Analysis

Attackers can exploit this to read sensitive files like the WordPress configuration file, which may contain database credentials and authentication keys. The attack requires a form with a file-upload field and a mail notification configured to attach the uploaded file and send it to an attacker-controlled email address.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive server files such as WordPress configuration files containing database credentials and authentication keys. Unauthorized access to such files may result in data breaches, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update the Bit Form plugin to version 3.1.0 or later immediately. Disable file-upload fields in forms if not required. Review and restrict mail notification settings to prevent file attachments from being sent externally.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart