CVE-2026-14372 is a path traversal vulnerability (CWE-22) in the Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder WordPress plugin. The issue arises from insufficient validation of file paths in the deleteFiles function, enabling authenticated attackers with subscriber-level privileges or higher to delete arbitrary files on the server. This improper limitation of pathname to a restricted directory can lead to remote code execution by deleting critical files such as wp-config.php. The vulnerability affects all versions up to and including 3.1.1. No official patch or remediation guidance has been provided yet.

Authenticated users with subscriber-level access or higher can delete arbitrary files on the server due to insufficient path validation. This can result in denial of service or remote code execution if critical files like wp-config.php are deleted. The vulnerability compromises the integrity and availability of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to file deletions. Avoid granting unnecessary privileges to users and consider disabling or removing the vulnerable plugin if feasible.