Junglewise Threat Intelligence

CVE-2026-14372: Bit Form WordPress Plugin arbitrary file deletion in deleteFiles

CVE-2026-14372 · Severity: high · CVSS 7.1 · Published 2026-07-09

Executive brief

The Bit Form plugin for WordPress, used for creating contact and payment forms, contains a security flaw that allows logged-in users to delete files from the web server. By deleting critical system files like configuration settings, an attacker could potentially take full control of the website or cause a total service outage. This risk is particularly high because even users with low-level 'subscriber' accounts can trigger the vulnerability.

Technical details

The Bit Form plugin for WordPress (versions up to 3.1.1) is vulnerable to arbitrary file deletion (CWE-22) due to insufficient path validation in the 'deleteFiles' function. Authenticated attackers with subscriber-level permissions or higher can exploit this via network requests to delete arbitrary files on the server. Deleting critical files such as 'wp-config.php' can lead to a site reset or remote code execution. The issue is addressed in version 3.1.2.

Affected products

  • bitpressadmin Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder <= 3.1.1

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References

Related threats