Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder

Information

Software Type Plugin
Software Slug bit-form (view on wordpress.org)
Software Status Active
Software Author bitpressadmin
Software Website www.bitapps.pro
Software Downloads 452,068
Software Active Installs 10,000
Software Record Last Updated August 11, 2026

Showing 1-20 of 25 Vulnerabilities

Submit a Vulnerability
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission
5.3
CVE-2026-15054
Jul 30, 2026
Researcher: Charles Vosburgh
Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
7.1
CVE-2026-14372
Jul 8, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read
7.5
CVE-2026-13693
Jun 30, 2026
Researcher: Davud Sahibzada
Bit Form <= 3.0.0 - Missing Authorization
5.3
CVE-2026-13694
Jun 30, 2026
Researcher: Davud Sahibzada
Bit Form <= 2.21.10 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2026-25418
Jan 28, 2026
Researcher: Trương Hữu Phúc (truonghuuphuc)
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
6.5
CVE-2025-14901
Jan 6, 2026
Researcher: andrea bocchetti
Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-6679
Aug 14, 2025
Researcher: Phat RiO
Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-13451
Jul 1, 2025
Researcher: Tim Coen
Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
4.9
CVE-2025-2580
Apr 24, 2025
Researcher: Avraham Shemesh
Bit Form – Contact Form Plugin <= 2.18.0 - Open Redirect
7.2
CVE-2025-30885
Mar 27, 2025
Researcher: Le Ngoc Anh
Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery
3.8
CVE-2024-13450
Jan 24, 2025
Researcher: Francesco Carlucci
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure
4.3
CVE-2024-12190
Dec 24, 2024
Researcher: Akbar Kustirama
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read
4.9
CVE-2024-9507
Oct 10, 2024
Researcher: TANG Cheuk Hei (siunam)
Bit Form – Contact Form Plugin <= 2.13.11 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2024-47335
Sep 26, 2024
Researcher: Certus Cybersecurity
Bit Form – Contact Form Plugin <= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVE-2024-47319
Sep 25, 2024
Researcher: Certus Cybersecurity
Bit Form – Contact Form Plugin <= 2.13.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-47301
Sep 24, 2024
Researcher: Manab Jyoti Dowarah
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function
7.2
CVE-2024-7702
Aug 19, 2024
Researcher: TANG Cheuk Hei (siunam)
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads
5.5
CVE-2024-7775
Aug 19, 2024
Researcher: TANG Cheuk Hei (siunam)
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
9.0
CVE-2024-7777
Aug 19, 2024
Researcher: TANG Cheuk Hei (siunam)
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2024-7780
Aug 19, 2024
Researcher: TANG Cheuk Hei (siunam)
Title Status CVE ID CVSS Researchers Date
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission Patched CVE-2026-15054 5.3 Charles Vosburgh July 30, 2026
Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter Patched CVE-2026-14372 7.1 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) July 8, 2026
Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read Patched CVE-2026-13693 7.5 Davud Sahibzada June 30, 2026
Bit Form <= 3.0.0 - Missing Authorization Patched CVE-2026-13694 5.3 Davud Sahibzada June 30, 2026
Bit Form <= 2.21.10 - Authenticated (Administrator+) SQL Injection Patched CVE-2026-25418 4.9 Trương Hữu Phúc (truonghuuphuc) January 28, 2026
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay Patched CVE-2025-14901 6.5 andrea bocchetti January 6, 2026
Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload Patched CVE-2025-6679 9.8 Phat RiO August 14, 2025
Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure Patched CVE-2024-13451 5.3 Tim Coen July 1, 2025
Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Patched CVE-2025-2580 4.9 Avraham Shemesh April 24, 2025
Bit Form – Contact Form Plugin <= 2.18.0 - Open Redirect Patched CVE-2025-30885 7.2 Le Ngoc Anh March 27, 2025
Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery Patched CVE-2024-13450 3.8 Francesco Carlucci January 24, 2025
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure Patched CVE-2024-12190 4.3 Akbar Kustirama December 24, 2024
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read Patched CVE-2024-9507 4.9 TANG Cheuk Hei (siunam) October 10, 2024
Bit Form – Contact Form Plugin <= 2.13.11 - Authenticated (Administrator+) SQL Injection Patched CVE-2024-47335 4.9 Certus Cybersecurity September 26, 2024
Bit Form – Contact Form Plugin <= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload Patched CVE-2024-47319 7.2 Certus Cybersecurity September 25, 2024
Bit Form – Contact Form Plugin <= 2.13.10 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-47301 7.2 Manab Jyoti Dowarah September 24, 2024
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function Patched CVE-2024-7702 7.2 TANG Cheuk Hei (siunam) August 19, 2024
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads Patched CVE-2024-7775 5.5 TANG Cheuk Hei (siunam) August 19, 2024
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion Patched CVE-2024-7777 9.0 TANG Cheuk Hei (siunam) August 19, 2024
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection Patched CVE-2024-7780 7.2 TANG Cheuk Hei (siunam) August 19, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation