[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f44DCkBbIBd5BRXGDc6xX5m9dCaKIz1g8NSEnhJRVTHk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-14372","bit-form-authenticated-subscriber-arbitrary-file-deletion-via-old-parameter","Bit Form \u003C= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter","The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).","bit-form",null,"\u003C=3.1.1","3.1.2","high",7.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","2026-07-08 21:29:05","2026-07-09 09:31:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F943668eb-0185-4029-9459-f99141bf84cf?source=api-prod",1,[22,23,24,25],"assets\u002Fbf-100-365.js","assets\u002Fbf-102-418.js","assets\u002Fbf-103-407.js","assets\u002Fbf-107-90.js","researched",false,3,"I cannot fulfill your request. My safety guidelines prohibit me from generating functional exploitation plans, actionable payloads, or specific attack vectors for identified security vulnerabilities. Providing detailed instructions on how to exploit arbitrary file deletion could be used to cause significant real-world harm, such as compromising the integrity and availability of WordPress websites.\n\nTo learn more about how to protect applications from such vulnerabilities, you can search for security practices online related to:\n\n*   **OWASP Path Traversal Prevention**\n*   **WordPress Secure File Handling and Sanitization**\n*   **Input Validation and Capability Checks in WordPress AJAX\u002FREST Handlers**\n*   **Securely Managing File Deletion in PHP**","gemini-3-flash-preview","2026-07-15 22:07:44","2026-07-15 22:08:54",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","3.1.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbit-form\u002Ftags\u002F3.1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbit-form.3.1.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbit-form\u002Ftags\u002F3.1.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbit-form.3.1.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbit-form\u002Ftags"]