CVE-2026-14372: Bit Form Arbitrary File Deletion Vulnerability in WordPress

Technical summary

CVE-2026-14372 is a path traversal vulnerability in Bit Form's deleteFiles function that fails to properly validate or sanitize file paths before deletion. An authenticated user with subscriber-level privileges or higher can exploit this to delete any file readable by the web server process, including core WordPress configuration and executable files. The vulnerability is particularly dangerous because deletion of wp-config.php or similar critical files can enable remote code execution or complete site takeover. The CVSS 3.1 score of 7.1 (HIGH) reflects the combination of low attack complexity, network accessibility, and the availability impact of arbitrary file deletion.

Business impact

Organizations running Bit Form face multiple business risks from this vulnerability. A malicious insider or compromised low-privilege account can destroy site availability by deleting critical configuration or database files. Deletion of wp-config.php immediately breaks WordPress functionality and exposes database credentials in plaintext backups. For e-commerce sites using Bit Form for payment collection, file deletion could compromise payment processing, customer data integrity, or PCI-DSS compliance. Incident response costs, downtime, and potential data breach notifications add significant financial exposure.

Affected systems

Any WordPress site running Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin version 3.1.1 or earlier is vulnerable. The attack requires only subscriber-level access or higher, a privilege level commonly granted to contributors, authors, and editors. Sites that have not updated to a patched version remain at risk regardless of other security controls.

Exploitability

Exploitation is straightforward and requires low technical skill. An attacker needs only valid subscriber credentials (obtained through credential compromise, account takeover, or intentional creation by a malicious insider) and network access to the WordPress admin area or REST API. No user interaction is needed. The attack can be automated and scaled across multiple targets. Threat actors actively targeting WordPress sites would quickly weaponize this flaw.

Remediation

Immediately update Bit Form to the latest patched version released after 3.1.1; verify the version number against the official plugin repository or vendor advisory. For sites unable to patch immediately, restrict subscriber-level access and review user roles—remove unnecessary accounts and demote non-essential users to 'no role' status. Consider disabling the plugin entirely until a patch is confirmed and tested. Monitor file system access logs for unexpected deletion patterns.

Patch guidance

Update the plugin via the WordPress admin dashboard (Plugins > Installed Plugins > Bit Form, then click 'Update Now') or manually via FTP/SFTP by downloading the latest version from wordpress.org. Verify in Settings > Plugins that the version number is greater than 3.1.1. Test the update on a staging environment first to ensure no form functionality is broken. After patching, audit recent file deletion logs to detect any prior exploitation.

Detection guidance

Monitor WordPress access logs (typically wp-admin/admin-ajax.php requests) for POST calls to the deleteFiles function or related AJAX handlers from low-privilege user accounts. Check file system audit logs (auditd on Linux, Windows Event Log on Windows) for unexpected file deletions in wp-config.php, .htaccess, or wp-content/plugins directories. Look for rapid or bulk deletion requests that do not correlate with normal site maintenance. Review WordPress user audit logs if available via security plugins to identify which accounts initiated deletions.

Why prioritize this

This vulnerability merits immediate patching because it combines low attack complexity, low privilege requirements, and direct availability impact. Subscriber-level accounts are common in organizations and easily compromised. File deletion can be used as a stepping stone to RCE or permanent site destruction, making it a favorite vector for ransomware campaigns. The plugin's popularity in the WordPress ecosystem increases the number of exposed sites.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: AV:N (network-accessible), AC:L (no special conditions required), PR:L (subscriber access required but common), UI:N (no user interaction needed), and A:H (high availability impact from file deletion). The vector does not account for confidentiality impact from wp-config exposure post-deletion, understating real-world risk for many deployments. Organizations handling sensitive data or payments should treat this as CRITICAL priority.

Frequently asked questions