Media File Deletion Vulnerability in weForms Plugin for WordPress
CVE-2026-110253

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Weforms – Easy Drag & Drop Contact Form Builder For WordPress
Vendor
CVE Published:
17 October 2026

What is CVE-2026-110253?

The weForms plugin for WordPress contains a vulnerability that allows unauthenticated attackers to delete arbitrary media files from the server due to insufficient validation of file paths in the 'weforms_delete_entry_attachments' function. This issue affects all versions up to and including 1.6.28. An attacker can exploit this vulnerability by social engineering an administrator into permanently deleting a compromised form entry, which is a common moderation task for entries that appear to be spam.

Affected Version(s)

weForms – Easy Drag & Drop Contact Form Builder For WordPress 0 <= 1.6.28

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/weforms/tags/1...
https://plugins.trac.wordpress.org/browser/weforms/tags/1...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kuba
.