# CVE-2026-14372: Bit Form WordPress Plugin arbitrary file deletion in deleteFiles

Source: https://junglewise.ai/threats/cve-2026-14372-bit-form-wordpress-plugin-arbitrary-file-deletion-in-deletefiles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-14372 · Severity: high · CVSS 7.1 · Published 2026-07-09

The Bit Form plugin for WordPress, used for creating contact and payment forms, contains a security flaw that allows logged-in users to delete files from the web server. By deleting critical system files like configuration settings, an attacker could potentially take full control of the website or cause a total service outage. This risk is particularly high because even users with low-level 'subscriber' accounts can trigger the vulnerability.

Technologies: [Bit Apps Bit Form](https://junglewise.ai/threats/technologies/bit-form). Vendors: [Bit Apps](https://junglewise.ai/threats/vendors/bit-apps).

## Quick answers

**Is CVE-2026-14372 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14372 being exploited in the wild.

**How severe is CVE-2026-14372?** High severity, with a CVSS score of 7.1, published 9 July 2026.

**Which products and versions are affected?** Bit Apps Bit Form <= 3.1.1.

**Is there a fix for CVE-2026-14372?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14372 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14372?** Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Bit Form plugin for WordPress (versions up to 3.1.1) is vulnerable to arbitrary file deletion (CWE-22) due to insufficient path validation in the 'deleteFiles' function. Authenticated attackers with subscriber-level permissions or higher can exploit this via network requests to delete arbitrary files on the server. Deleting critical files such as 'wp-config.php' can lead to a site reset or remote code execution. The issue is addressed in version 3.1.2.

## Affected products

- bitpressadmin Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder <= 3.1.1

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: advisory

## References

- [https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Admin/Form/Helpers.php](https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Admin/Form/Helpers.php)
- [https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php](https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php)
- [https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php](https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php)
- [https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Util/FileHandler.php](https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Util/FileHandler.php)
- [https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Frontend/Ajax/FrontendAjax.php](https://plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Frontend/Ajax/FrontendAjax.php)
- [https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/Helpers.php](https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/Helpers.php)
- [https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Form/FormManager.php](https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Form/FormManager.php)

## Related threats

- [Bit Apps Bit Form stored XSS in Conversational Form Progress Label](https://junglewise.ai/threats/cve-2025-15669-bit-apps-bit-form-stored-xss-in-conversational-form-progress)
- [Bit Apps Bit Form missing authorization for inactive form submission](https://junglewise.ai/threats/cve-2026-15054-bit-apps-bit-form-missing-authorization-for-inactive-form)
- [Bit Apps Bit Form authentication bypass in workflow trigger](https://junglewise.ai/threats/cve-2026-13694-bit-apps-bit-form-authentication-bypass-in-workflow-trigger)
- [Bit Apps Bit Form path traversal in file-field attachments](https://junglewise.ai/threats/cve-2026-13693-bit-apps-bit-form-path-traversal-in-file-field-attachments)
- [Bit Apps BitForm Stored XSS in bitform shortcode](https://junglewise.ai/threats/cve-2026-8891-bit-apps-bitform-stored-xss-in-bitform-shortcode)