What is the CVSS score of CVE-2026-14372?

CVE-2026-14372 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.7%.

Which versions of Bit Form are affected by CVE-2026-14372?

The Bit Form WordPress plugin (all versions through 3.1.1) contains an arbitrary file deletion vulnerability that allows low-privileged authenticated users to remove critical system files, resulting…

How to fix or mitigate CVE-2026-14372?

Within 24 hours: identify all WordPress sites running Bit Form plugin (versions ≤3.1.1), document installed versions and active user accounts, disable or deactivate the plugin across all instances. Within 7 days: restrict new user registration capabilities, review authentication and file system access logs for suspicious deletion activity, deploy file integrity monitoring on critical files (wp-config.php, index.php). Within 30 days: evaluate alternative form plugins; monitor vendor advisories for Bit Form patch release; upon patch availability, test in staging environment before production deployment.

Bit Form CVE-2026-14372

EUVD-2026-42564 HIGH

Path Traversal (CWE-22)

2026-07-09 Wordfence

GHSA-6xr5-pj36-4gcg

WordPress Path Traversal RCE Bit Form Contact Form Payment Forms Multi Step Forms Calculator Custom Form Builder

7.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

vuln.today AI

8.1 HIGH

Network-reachable AJAX endpoint (AV:N/AC:L) needing only subscriber auth (PR:L); arbitrary file deletion is primarily an integrity and availability loss (I:H/A:H) with no direct data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:30 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

HIGH 7.1

DescriptionCVE.org

The Bit Form - Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).

AnalysisAI

Arbitrary file deletion in the Bit Form WordPress plugin (all versions through 3.1.1) lets low-privileged authenticated users delete any file on the server via an unsanitized path passed to the deleteFiles function. Because a subscriber-level attacker can remove critical files such as wp-config.php, this path traversal escalates into a full site takeover / remote code execution scenario. Reported by Wordfence with a CVSS of 7.1; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Bit Form, a WordPress form-builder plugin (vendor bitpressadmin) providing contact, payment, multi-step, and calculator forms. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the deleteFiles routine in includes/Core/Util/FileHandler.php (line 129) accepts an attacker-influenced file path without validating that it resolves inside an intended upload directory, and that path flows from the frontend AJAX handler (includes/Frontend/Ajax/FrontendAjax.php:87) through FormManager.php (lines 1039/1044) and Helpers.php:302. Without canonicalization or an allow-list boundary check, traversal sequences let the deletion target escape the plugin's storage area and reach arbitrary filesystem locations that the PHP/web-server process can write to.

RemediationAI

Vendor-released patch: update the Bit Form plugin to version 3.1.2 or later, which fixes the deleteFiles path validation (see the trac changeset https://plugins.trac.wordpress.org/changeset/3598554/bit-form/trunk/includes/Core/Form/FormManager.php and the 3.1.1→3.1.2 diff https://plugins.trac.wordpress.org/changeset?old_path=%2Fbit-form/tags/3.1.1&new_path=%2Fbit-form/tags/3.1.2). If immediate patching is not possible, reduce exposure by disabling open user registration or setting the default role so untrusted users cannot obtain subscriber-level access (trade-off: breaks legitimate self-service signup), and restrict or block the plugin's frontend file-handling AJAX endpoint via a WAF rule or by deactivating the plugin entirely until upgraded (trade-off: form functionality is lost). Also verify integrity of wp-config.php and other critical files, and consult the Wordfence advisory above for detection guidance.