CVE-2026-13693

medium

Description

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

References

https://wpscan.com/vulnerability/3a01cd45-1d36-4e36-aca8-947353c474a7/

Details

Source: Mitre, NVD

Published: 2026-07-21

Updated: 2026-07-21

Risk Information

CVSS v2

Base Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N