SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-13693

MEDIUM · CVSS 5.9 EPSS 0.28%

Source: NVD + CISA KEV + EPSS · Published 2026-07-21 · Last synced 2026-08-20

CyberRota Analysis

AI-Generated

The Bit Form WordPress plugin prior to version 3.1.0 is vulnerable due to inadequate validation of file-field values, enabling unauthenticated attackers to access sensitive server files, including the WordPress configuration file. This could lead to unauthorized exposure of critical information, potentially compromising the entire WordPress installation. Website administrators using this plugin should prioritize updating to the latest version to mitigate the risk.

CVE
CVE-2026-13693
Severity
MEDIUM
CVSS
5.9
EPSS
0.28%
WordPress

Original NVD Description

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.