CVE-2026-14372
HighCVSS 7.1Summary
The Bit Form plugin for WordPress up to version 3.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.
Risk Assessment
The risk involves the potential deletion of critical configuration files like wp-config.php, which can lead to remote code execution and full compromise of the WordPress site.
Recommendation
It is recommended to immediately update the Bit Form plugin to the latest available version that fixes this vulnerability. Also, restrict user permissions to the minimum necessary.
Other vulnerabilities in Bit Form
See all- CVE-2026-16573High
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when viewed, leading to Stored Cross-Site Scripting.
- CVE-2025-15669Medium
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
- CVE-2026-13694Medium
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Original NVD description (English source)
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).