CVE-2025-14901

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14901", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-18T16:33:20.699Z", "datePublished": "2026-01-07T06:35:57.705Z", "dateUpdated": "2026-04-08T16:33:04.061Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:04.061Z"}, "affected": [{"vendor": "bitpressadmin", "product": "Bit Form \u2013 Custom Contact Form, Multi Step, Conversational Form & Payment Form builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.21.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Bit Form \u2013 Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification fails and the user is logged in. This makes it possible for unauthenticated attackers to replay form workflow executions and trigger all configured integrations including webhooks, email notifications, CRM integrations, and automation platforms via the bitforms_trigger_workflow AJAX action granted they can obtain the entry ID and log IDs from a legitimate form submission response."}], "title": "Bit Form \u2013 Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L146"}, {"url": "https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L30"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429172%40bit-form%2Ftrunk&old=3420966%40bit-form%2Ftrunk&sfp_email=&sfph_mail=#file827"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-18T16:48:55.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-06T17:34:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:52:47.173907Z", "id": "CVE-2025-14901", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:14:30.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14901", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:52:47.173907Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:52:49.456Z"}}], "cna": {"title": "Bit Form \u2013 Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "bitpressadmin", "product": "Bit Form \u2013 Custom Contact Form, Multi Step, Conversational Form & Payment Form builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.21.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-18T16:48:55.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-06T17:34:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L146"}, {"url": "https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L30"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429172%40bit-form%2Ftrunk&old=3420966%40bit-form%2Ftrunk&sfp_email=&sfph_mail=#file827"}], "descriptions": [{"lang": "en", "value": "The Bit Form \u2013 Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification fails and the user is logged in. This makes it possible for unauthenticated attackers to replay form workflow executions and trigger all configured integrations including webhooks, email notifications, CRM integrations, and automation platforms via the bitforms_trigger_workflow AJAX action granted they can obtain the entry ID and log IDs from a legitimate form submission response."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T06:35:57.705Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14901", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:14:30.203Z", "dateReserved": "2025-12-18T16:33:20.699Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T06:35:57.705Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Bit Form \u2013 Custom Contact Form, Multi Step, Conversational Form & Payment Form builder", "vendor": "bitpressadmin", "versions": [{"lessThanOrEqual": "2.21.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Bit Form \u2013 Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification fails and the user is logged in. This makes it possible for unauthenticated attackers to replay form workflow executions and trigger all configured integrations including webhooks, email notifications, CRM integrations, and automation platforms via the bitforms_trigger_workflow AJAX action granted they can obtain the entry ID and log IDs from a legitimate form submission response."}, {"lang": "es", "value": "El plugin Bit Form - Contact Form Plugin para WordPress es vulnerable a la ejecuci\u00f3n no autorizada de flujos de trabajo debido a la falta de autorizaci\u00f3n en la funci\u00f3n triggerWorkFlow en todas las versiones hasta la 2.21.6, inclusive. Esto se debe a un fallo l\u00f3gico en la verificaci\u00f3n del nonce, donde la comprobaci\u00f3n de seguridad solo bloquea las solicitudes cuando falla la verificaci\u00f3n del nonce y el usuario ha iniciado sesi\u00f3n. Esto permite a atacantes no autenticados reproducir ejecuciones de flujos de trabajo de formularios y activar todas las integraciones configuradas, incluyendo webhooks, notificaciones por correo electr\u00f3nico, integraciones de CRM y plataformas de automatizaci\u00f3n, a trav\u00e9s de la acci\u00f3n AJAX bitforms_trigger_workflow, siempre que puedan obtener el ID de entrada y los ID de registro de una respuesta de env\u00edo de formulario leg\u00edtima."}], "id": "CVE-2025-14901", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14901", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:52:47.173907Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:57.940", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L146"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429172%40bit-form%2Ftrunk&old=3420966%40bit-form%2Ftrunk&sfp_email=&sfph_mail=#file827"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:54:52.921183+00:00", "value": {"mitigation_remediation": ["Update the Bit Form plugin to the latest version (after 2.21.6) where the authorization check has been fixed. ", "Optionally disable or restrict any webhook, email, CRM or automation integrations that are not needed immediately to reduce attack surface until the patch is applied. ", "As a temporary workaround, block unauthenticated access to the bitforms_trigger_workflow AJAX action, for example by adding PHP code or a plugin that checks for logged\u2011in status before executing workflow logic. ", "Monitor plugin configuration and logs for suspicious repeated workflow executions."], "summary": {"action": "Patch", "impact": "Unauthorized replay of form workflows triggering integrations"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Bit Form \u2013 Custom Contact Form, Multi Step, Conversational Form & Payment Form builder plugin version 2.21.6 or earlier are affected. The vulnerability exists in all releases up to and including 2.21.6.", "description_and_impact": "The Bit Form \u2013 Contact Form Plugin for WordPress is vulnerable to unauthorized workflow execution caused by a missing authorization check in the triggerWorkFlow logic. The nonce verification only blocks requests when both the nonce fails and the user is logged in, meaning unauthenticated users can supply a valid nonce and replay a previously recorded workflow. Attackers can trigger all configured integrations\u2014including webhooks, email notifications, CRM integrations, and automation platforms\u2014via the bitforms_trigger_workflow AJAX action once they obtain an entry ID and log IDs from a legitimate form submission. This flaw enables remote execution of arbitrary integration actions without authentication, posing a consent abuse and potential data leakage risk.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity; however, the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploitation. Attackers would need to obtain a legitimate entry ID and log ID, which can be gleaned from a normal form submission, and then send a crafted AJAX request to the bitforms_trigger_workflow action. Because the flaw relies on missing authorization rather than insecure input or remote code execution, the risk is moderate but still significant for sites with active integrations."}}}}, "created": "2026-01-08T09:50:01.406393+00:00", "updated": "2026-04-22T16:00:12.101290+00:00", "vendors": ["bitpressadmin", "bitpressadmin$PRODUCT$bit_form", "wordpress", "wordpress$PRODUCT$wordpress"]}