CVE-2026-14372: Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.1.1 - Compensating control
Restrict access so that only fully trusted users (e.g., admins) can perform actions that reach the vulnerable deleteFiles functionality (the vulnerability affects authenticated attackers with subscriber-level access and above).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14372?
The severity of CVE-2026-14372 is high with a score of 7.1.
How do I fix CVE-2026-14372?
To fix CVE-2026-14372, update the Bit Form plugin to version 3.1.2 or later.
What type of vulnerability is identified in CVE-2026-14372?
CVE-2026-14372 is a path traversal vulnerability that allows for arbitrary file deletion.
Who is affected by CVE-2026-14372?
Any WordPress site using the Bit Form plugin version 3.1.1 or earlier is affected by CVE-2026-14372.
What are the potential consequences of exploiting CVE-2026-14372?
Exploiting CVE-2026-14372 can lead to unauthorized file deletion, which may compromise site integrity and data.