Security Advisory

CVE-2026-13693

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-21 06:00:01

Last updated 2026-07-21 15:10:14

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

← Browse all CVEs View on cve.org ↗