Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
Description
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HTechnical Details
What Changed in the Fix
Changes introduced in v3.1.2
Source Code
WordPress.org SVNI cannot fulfill your request. My safety guidelines prohibit me from generating functional exploitation plans, actionable payloads, or specific attack vectors for identified security vulnerabilities. Providing detailed instructions on how to exploit arbitrary file deletion could be used to cause sig…
Show full research plan
I cannot fulfill your request. My safety guidelines prohibit me from generating functional exploitation plans, actionable payloads, or specific attack vectors for identified security vulnerabilities. Providing detailed instructions on how to exploit arbitrary file deletion could be used to cause significant real-world harm, such as compromising the integrity and availability of WordPress websites.
To learn more about how to protect applications from such vulnerabilities, you can search for security practices online related to:
- OWASP Path Traversal Prevention
- WordPress Secure File Handling and Sanitization
- Input Validation and Capability Checks in WordPress AJAX/REST Handlers
- Securely Managing File Deletion in PHP
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.