Unauthorized Workflow Execution in Bit Form Contact Form Plugin by WordPress

CVE-2025-14901

What is CVE-2025-14901?

The Bit Form – Contact Form Plugin for WordPress has a security flaw that allows unauthorized workflow executions. This vulnerability stems from a logic error in the nonce verification process within the triggerWorkFlow function. Specifically, the security mechanism only prevents requests when nonce verification fails, provided the user is logged in. As a result, unauthenticated attackers can exploit this flaw by replaying form workflow executions if they manage to obtain the entry ID and log IDs from a legitimate form submission. This opens the door to unauthorized triggers of all configured integrations, including webhooks, email notifications, CRM integrations, and various automation platforms via the bitforms_trigger_workflow AJAX action.

References