CVE-2025-14901

The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification fails and the user is logged in. This makes it possible for unauthenticated attackers to replay form workflow executions and trigger all configured integrations including webhooks, email notifications, CRM integrations, and automation platforms via the bitforms_trigger_workflow AJAX action granted they can obtain the entry ID and log IDs from a legitimate form submission response.

• CWE-862

• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L146
• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.21.6/includes/Frontend/Ajax/FrontendAjax.php#L30
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429172%40bit-form%2Ftrunk&old=3420966%40bit-form%2Ftrunk&sfp_email=&sfph_mail=#file827
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=cve

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14896due to insufficient sanitazation in Vega’s `convert()` funct…8.7
• CVE-2025-14897A vulnerability was identified in CodeAstro Real Estate Mana…7.2
• CVE-2025-14898A security flaw has been discovered in CodeAstro Real Estate…7.2
• CVE-2025-14899A weakness has been identified in CodeAstro Real Estate Mana…7.2
• CVE-2025-1490The Smart Maintenance Mode plugin for WordPress is vulnerabl…6.1
• CVE-2025-14900A security vulnerability has been detected in CodeAstro Real…7.2
• CVE-2025-14903The Simple Crypto Shortcodes plugin for WordPress is vulnera…4.3
• CVE-2025-14904The Newsletter Email Subscribe plugin for WordPress is vulne…4.3
• CVE-2025-14905A flaw was found in the 389-ds-base server. A heap buffer ov…7.2
• CVE-2025-14906The WP Youtube Video Gallery plugin for WordPress is vulnera…4.3
• CVE-2025-14907The Moderate Selected Posts plugin for WordPress is vulnerab…4.3
• CVE-2025-14908A security flaw has been discovered in JeecgBoot up to 3.9.0…8.1