{
 "id": "WPSEC-2026-1517",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1517/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1517/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1517/index.md",
 "title": "Bit Form <= 3.3.1 - Authenticated (Subscriber+) Arbitrary File Deletion via Entry Editing 'entryID' Parameter",
 "description": "The Bit Form plugin for WordPress is vulnerable to arbitrary file deletion via the entry editing feature in all versions up to, and including, 3.3.1, due to insufficient validation of the entry and form ID values. They are not restricted to plain numbers and are used to build the entry's upload directory path. The Dropbox and OneDrive integrations' 'Delete from WordPress' option then deletes files from that path without checking that they stay inside the entry's upload folder. This makes it possible for authenticated attackers, with Subscriber-level access and above, who are allowed to edit one of their own form entries, to submit an entry ID containing path traversal sequences. When the form has a Dropbox or OneDrive integration with 'Delete from WordPress' enabled, this deletes arbitrary files on the server outside the Bit Form upload folder, such as wp-config.php, which can lead to site takeover.",
 "plugin": {
  "slug": "bit-form",
  "name": "Bit Form",
  "full_name": "Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/bit-form/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bit-form/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bit-form"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.4.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.4.0",
 "remediation": "Update to 3.4.0 or later.",
 "fix_released": "2026-10-22T12:15:19+00:00",
 "published": "2026-10-23T12:43:24+00:00",
 "updated": "2026-10-23T07:09:42.862014+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1517/",
  "https://plugins.svn.wordpress.org/bit-form/tags/3.4.0/",
  "https://wordpress.org/plugins/bit-form/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bit-form",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}