# Bit Form <= 3.3.1 - Authenticated (Subscriber+) Arbitrary File Deletion via Entry Editing 'entryID' Parameter

- **ID:** WPSEC-2026-1517
- **Plugin:** Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder (`bit-form`), https://wordpress.org/plugins/bit-form/
- **Affected versions:** all versions before 3.4.0
- **Fixed in:** 3.4.0 (Update to 3.4.0 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bit-form
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1517/

## Description

The Bit Form plugin for WordPress is vulnerable to arbitrary file deletion via the entry editing feature in all versions up to, and including, 3.3.1, due to insufficient validation of the entry and form ID values. They are not restricted to plain numbers and are used to build the entry's upload directory path. The Dropbox and OneDrive integrations' 'Delete from WordPress' option then deletes files from that path without checking that they stay inside the entry's upload folder. This makes it possible for authenticated attackers, with Subscriber-level access and above, who are allowed to edit one of their own form entries, to submit an entry ID containing path traversal sequences. When the form has a Dropbox or OneDrive integration with 'Delete from WordPress' enabled, this deletes arbitrary files on the server outside the Bit Form upload folder, such as wp-config.php, which can lead to site takeover.

## References

- https://wpsec.com/vuln/WPSEC-2026-1517/
- https://plugins.svn.wordpress.org/bit-form/tags/3.4.0/
- https://wordpress.org/plugins/bit-form/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1517/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.