CVE-2026-14372 Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter

🗓️ 09 Jul 2026 09:31:21Reported by WordfenceType

Authenticated subscribers can delete arbitrary files via the _old parameter in Bit Form up to version 3.1.1, risking remote code execution.

Reporter	Title	Published	Views	Family All 4
ATTACKERKB	CVE-2026-14372	9 Jul 202609:31	–	attackerkb
CVE	CVE-2026-14372	9 Jul 202609:31	–	cve
NVD	CVE-2026-14372	9 Jul 202611:16	–	nvd
Positive Technologies	PT-2026-56771	9 Jul 202600:00	–	ptsecurity

[
  {
    "vendor": "bitpressadmin",
    "product": "Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Admin/Form/Helpers.php
plugins	www.plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Form/FormManager.php
plugins	www.plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Frontend/Ajax/FrontendAjax.php
plugins	www.plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Util/FileHandler.php
plugins	www.plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Form/FormManager.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/943668eb-0185-4029-9459-f99141bf84cf
plugins	www.plugins.trac.wordpress.org/browser/bit-form/tags/3.1.1/includes/Core/Util/FileHandler.php
plugins	www.plugins.trac.wordpress.org/changeset/3598554/bit-form/trunk/includes/Core/Form/FormManager.php
plugins	www.plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Form/FormManager.php

09 Jul 2026 09:31Current

CVSS 3.17.1

CWE-22