Bit Form <= 3.3.1 - Authenticated (Subscriber+) Arbitrary File Deletion via Entry Editing 'entryID' Parameter
- ID
- WPSEC-2026-1517
- Plugin
- Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder (bit-form)
- Affected
- all versions before 3.4.0
- Remediation
- Update to 3.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Bit Form on WPSec AttackSurface
- Fix released
- Published
Description
The Bit Form plugin for WordPress is vulnerable to arbitrary file deletion via the entry editing feature in all versions up to, and including, 3.3.1, due to insufficient validation of the entry and form ID values. They are not restricted to plain numbers and are used to build the entry's upload directory path. The Dropbox and OneDrive integrations' 'Delete from WordPress' option then deletes files from that path without checking that they stay inside the entry's upload folder. This makes it possible for authenticated attackers, with Subscriber-level access and above, who are allowed to edit one of their own form entries, to submit an entry ID containing path traversal sequences. When the form has a Dropbox or OneDrive integration with 'Delete from WordPress' enabled, this deletes arbitrary files on the server outside the Bit Form upload folder, such as wp-config.php, which can lead to site takeover.
References
- https://wpsec.com/vuln/WPSEC-2026-1517/
- https://plugins.svn.wordpress.org/bit-form/tags/3.4.0/
- https://wordpress.org/plugins/bit-form/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS