Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder Security & Risk Analysis

wordpress.org/plugins/bit-form

Contact Form Builder for WordPress with payment forms, multistep forms, conversational forms, conditional logic, and integrations.

10K active installs v3.2.0 PHP 7.4+ WP 6.4+ Updated Jul 21, 2026
contact-formformform-builderform-pluginwp-forms
75
B · Generally Safe
CVEs total22
Unpatched0
Last CVEJul 8, 2026
Safety Verdict

Is Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder Safe to Use in 2026?

Mostly Safe

Score 75/100

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder is generally safe to use. 22 past CVEs were resolved.

22 known CVEsLast CVE: Jul 8, 2026Updated 1mo ago
Risk Assessment
Assessment pending
Vulnerabilities
22 published

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder Security Vulnerabilities

CVEs by Year

2 CVEs in 2023
2023
12 CVEs in 2024
2024
5 CVEs in 2025
2025
3 CVEs in 2026
2026
Patched Has unpatched

Severity Breakdown

Critical
3
High
8
Medium
10
Low
1

22 total CVEs

CVE-2026-14372high · 7.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter

Jul 8, 2026 Patched in 3.1.2 (1d)
CVE-2026-25418medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Bit Form <= 2.21.10 - Authenticated (Administrator+) SQL Injection

Jan 28, 2026 Patched in 2.21.11 (30d)
CVE-2025-14901medium · 6.5Missing Authorization

Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay

Jan 6, 2026 Patched in 2.21.7 (1d)
CVE-2025-6679critical · 9.8Unrestricted Upload of File with Dangerous Type

Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload

Aug 14, 2025 Patched in 2.20.4 (1d)
CVE-2024-13451medium · 5.3Exposure of Sensitive Information to an Unauthorized Actor

Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure

Jul 1, 2025 Patched in 2.17.6 (1d)
CVE-2025-2580medium · 4.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Apr 24, 2025 Patched in 2.18.4 (1d)
CVE-2025-30885high · 7.2URL Redirection to Untrusted Site ('Open Redirect')

Bit Form – Contact Form Plugin <= 2.18.0 - Open Redirect

Mar 27, 2025 Patched in 2.18.1 (8d)
CVE-2024-13450low · 3.8Server-Side Request Forgery (SSRF)

Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery

Jan 24, 2025 Patched in 2.17.5 (1d)
CVE-2024-12190medium · 4.3Missing Authorization

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure

Dec 24, 2024 Patched in 2.17.4 (1d)
CVE-2024-9507medium · 4.9Improper Input Validation

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read

Oct 10, 2024 Patched in 2.15.3 (1d)
CVE-2024-47335medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Bit Form – Contact Form Plugin <= 2.13.11 - Authenticated (Administrator+) SQL Injection

Sep 26, 2024 Patched in 2.13.12 (8d)
CVE-2024-47319high · 7.2Unrestricted Upload of File with Dangerous Type

Bit Form – Contact Form Plugin <= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload

Sep 25, 2024 Patched in 2.13.11 (8d)
CVE-2024-47301high · 7.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Bit Form – Contact Form Plugin <= 2.13.10 - Unauthenticated Stored Cross-Site Scripting

Sep 24, 2024 Patched in 2.13.11 (9d)
CVE-2024-7702high · 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function

Aug 19, 2024 Patched in 2.13.10 (1d)
CVE-2024-7775medium · 5.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads

Aug 19, 2024 Patched in 2.13.10 (1d)
CVE-2024-7777critical · 9Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion

Aug 19, 2024 Patched in 2.13.10 (1d)
CVE-2024-7780high · 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection

Aug 19, 2024 Patched in 2.13.10 (1d)
CVE-2024-7782high · 8.7Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion

Aug 19, 2024 Patched in 2.13.5 (317d)
CVE-2024-6123high · 7.2Unrestricted Upload of File with Dangerous Type

Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload

Jul 8, 2024 Patched in 2.13.4 (38d)
CVE-2024-1640medium · 5.3Authorization Bypass Through User-Controlled Key

Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration

Mar 13, 2024 Patched in 2.10.2 (1d)
CVE-2023-3645medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Contact Form Builder by Bit Form <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Jul 24, 2023 Patched in 2.2.0 (183d)
CVE-2022-4774critical · 9.8Unrestricted Upload of File with Dangerous Type

Bit Form <= 1.8.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution

Apr 19, 2023 Patched in 1.9 (279d)
Version History

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder Release Timeline

Maintenance & Trust

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder Maintenance & Trust

Maintenance Signals

WordPress version tested7.0.2
Last updatedJul 21, 2026
PHP min version7.4
Downloads438K

Community Trust

Rating100/100
Number of ratings260
Active installs10K
Developer Profile

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder Developer Profile

Bit Apps

7 plugins · 60K total installs

75
trust score
Avg Security Score
94/100
Avg Patch Time
169 days
View full developer profile
FAQ

Frequently Asked Questions about Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder