EUVD-2026-42564
GHSA-6xr5-pj36-4gcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber account on target
-
DeliverySend crafted AJAX request to deleteFiles endpoint
-
ExploitTraverse path to delete wp-config.php
-
ExecutionWordPress enters setup mode
-
PersistReconnect to attacker DB
-
ImpactGain admin and execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with subscriber-level access or above (CVSS PR:L) on a WordPress site running Bit Form version ≤3.1.1, and reachability of the plugin's frontend AJAX file-deletion endpoint (FrontendAjax.php handler invoking deleteFiles). The concrete prerequisite is that the attacker can reach the deleteFiles code path with a controlled file path; the main limiting factor is that the site must permit low-privilege account access (self-registration open, or the attacker otherwise holds subscriber credentials) - no user interaction and no admin rights are needed. Full RCE additionally depends on which file is deleted (e.g., wp-config.php) and the web server process having permission to remove it. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.1) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction - a realistic threat because subscriber accounts are frequently self-registerable on WordPress sites. The scored impact (C:L/I:N/A:H) understates the described consequence: arbitrary deletion of wp-config.php is fundamentally an integrity/availability compromise that can cascade into RCE, so real-world integrity impact is arguably higher than I:N suggests. No EPSS score, POC, or KEV entry is present in the input, so exploitation is currently theoretical-but-easy rather than confirmed in the wild. Overall this is a genuine priority for any site running Bit Form with open registration, not a paper-tiger high-CVSS issue, but the absence of active-exploitation signals means it is not yet an emergency for hardened, registration-closed deployments. |
| Exploit ScenarioDerived | An attacker registers or obtains a subscriber account on a WordPress site running Bit Form ≤3.1.1, then sends a crafted AJAX request to the frontend file handler with a traversal path pointing at wp-config.php. WordPress, unable to find its configuration, drops into setup mode, allowing the attacker to reconnect the site to an attacker-controlled database and achieve administrative control and code execution. No public POC is identified in the provided data, but the low complexity (AC:L) makes exploitation straightforward once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Arbitrary file deletion in the Bit Form WordPress plugin (all versions through 3.1.1) lets low-privileged authenticated users delete any file on the server via an unsanitized path passed to the deleteFiles function. Because a subscriber-level attacker can remove critical files such as wp-config.php, this path traversal escalates into a full site takeover / remote code execution scenario. Reported by Wordfence with a CVSS of 7.1; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: update the Bit Form plugin to version 3.1.2 or later, which fixes the deleteFiles path validation (see the trac changeset https://plugins.trac.wordpress.org/changeset/3598554/bit-form/trunk/includes/Core/Form/FormManager.php and the 3.1.1→3.1.2 diff https://plugins.trac.wordpress.org/changeset?old_path=%2Fbit-form/tags/3.1.1&new_path=%2Fbit-form/tags/3.1.2). If immediate patching is not possible, reduce exposure by disabling open user registration or setting the default role so untrusted users cannot obtain subscriber-level access (trade-off: breaks legitimate self-service signup), and restrict or block the plugin's frontend file-handling AJAX endpoint via a WAF rule or by deactivating the plugin entirely until upgraded (trade-off: form functionality is lost). Also verify integrity of wp-config.php and other critical files, and consult the Wordfence advisory above for detection guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Bit Form, a WordPress form-builder plugin (vendor bitpressadmin) providing contact, payment, multi-step, and calculator forms. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the deleteFiles routine in includes/Core/Util/FileHandler.php (line 129) accepts an attacker-influenced file path without validating that it resolves inside an intended upload directory, and that path flows from the frontend AJAX handler (includes/Frontend/Ajax/FrontendAjax.php:87) through FormManager.php (lines 1039/1044) and Helpers.php:302. Without canonicalization or an allow-list boundary check, traversal sequences let the deletion target escape the plugin's storage area and reach arbitrary filesystem locations that the PHP/web-server process can write to.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Network-reachable AJAX endpoint (AV:N/AC:L) needing only subscriber auth (PR:L); arbitrary file deletion is primarily an integrity and availability loss (I:H/A:H) with no direct data disclosure (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Bit Form - Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).
Executive ViewAI
The Bit Form WordPress plugin (all versions through 3.1.1) contains an arbitrary file deletion vulnerability that allows low-privileged authenticated users to remove critical system files, resulting in complete website takeover and potential remote code execution. Any WordPress installation using this plugin faces immediate risk of unauthorized access, data loss, and operational disruption. Remediation requires immediate plugin disablement pending vendor patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately disable Bit Form plugin to eliminate attack surface, implement file integrity monitoring on critical WordPress configuration files, restrict low-privilege account creation and audit existing subscriber-level users, enforce automated daily backups with offline retention, monitor system logs for unauthorized file deletion attempts, and implement database change monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB