The Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in the bitforms_update_form_entry AJAX action. This flaw allows unauthenticated attackers to modify form submission data because the plugin does not properly validate user permissions before processing update requests. The issue affects all plugin versions up to 2.10.1. The CVSS 3.1 base score is 5.3, indicating a medium severity level, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available.

An attacker without authentication can modify form submission data, potentially altering or corrupting data collected through the affected forms. There is no indication of confidentiality or availability impact, but the integrity of form data can be compromised. This could affect the reliability of data collected via the plugin's forms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected AJAX action or disabling the plugin if feasible to prevent exploitation.