Executive brief
The Bit Form plugin for WordPress, used for creating contact and payment forms, contains a security flaw that allows logged-in users to delete files from the web server. By deleting critical system files like configuration settings, an attacker could potentially take full control of the website or cause a total service outage. This risk is particularly high because even users with low-level 'subscriber' accounts can trigger the vulnerability.
Technical details
The Bit Form plugin for WordPress (versions up to 3.1.1) is vulnerable to arbitrary file deletion (CWE-22) due to insufficient path validation in the 'deleteFiles' function. Authenticated attackers with subscriber-level permissions or higher can exploit this via network requests to delete arbitrary files on the server. Deleting critical files such as 'wp-config.php' can lead to a site reset or remote code execution. The issue is addressed in version 3.1.2.
Affected products
- bitpressadmin Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder <= 3.1.1
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Admin/Form/Helpers.php
- https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php
- https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php
- https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Util/FileHandler.php
- https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Frontend/Ajax/FrontendAjax.php
- https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/Helpers.php
- https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Form/FormManager.php