The Bit Form – Contact Form Plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the triggerWorkFlow function present in all versions up to 2.21.6. The nonce verification logic incorrectly restricts requests only when both the nonce check fails and the user is logged in, allowing unauthenticated attackers to replay form workflow executions by leveraging the bitforms_trigger_workflow AJAX action. Attackers must obtain entry and log IDs from legitimate form submission responses to exploit this flaw, which can trigger all configured integrations such as webhooks, email notifications, CRM integrations, and automation platforms.

An attacker who obtains entry and log IDs from legitimate form submissions can trigger form workflows without authentication, potentially causing unauthorized execution of integrations like webhooks, email notifications, CRM systems, and automation platforms. This could lead to unintended information disclosure or disruption of automated processes. The vulnerability does not directly impact confidentiality but affects integrity and availability of the affected workflows.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to form submission responses to prevent attackers from obtaining entry and log IDs, and consider disabling or limiting integrations triggered by workflows if feasible.