The Bit Form plugin for WordPress suffers from a missing capability check on the bitform-form-entry-edit endpoint in all versions up to 2.17.3. This authorization bypass allows any authenticated user with at least Subscriber privileges to access form submission data belonging to other users. The vulnerability is classified as CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, requiring privileges, no user interaction, and limited confidentiality impact. No patch or remediation information is currently available from the vendor or other sources.

An attacker with Subscriber-level access or higher can view all form submissions from other users, potentially exposing sensitive information collected via the plugin's forms. There is no impact on data integrity or availability. The confidentiality breach is limited to data accessible through the plugin's form entries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and consider disabling or replacing the plugin if unauthorized data access risk is unacceptable.