CVE-2026-15054 is a missing authorization vulnerability (CWE-862) in the Bit Form WordPress plugin versions prior to 3.1.2. The plugin fails to enforce the active or published status of forms on its public submission endpoints. As a result, unauthenticated attackers can submit data to forms that are supposed to be inactive or unpublished, potentially triggering configured workflows like email notifications. The CVSS v3.1 base score is 3.7 (low), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. No official patch or remediation level is indicated in the available data, and no known exploits are reported in the wild.

The impact is limited to the integrity of form submissions and associated workflows. Attackers can submit entries to inactive or unpublished forms, potentially causing unintended processing such as sending email notifications. There is no impact on confidentiality or availability. The overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected form submission endpoints or applying custom access controls to prevent unauthorized submissions to inactive forms.