Arbitrary File Deletion Vulnerability in Nex Forms Plugin for WordPress

CVE-2026-15450

What is CVE-2026-15450?

The Nex Forms - Ultimate Form Builder - Lite plugin for WordPress has a vulnerability that allows authenticated attackers with admin-level access to delete arbitrary files from the server through a path traversal exploit. The vulnerability arises from the delete_file() AJAX handler, which inadequately processes file paths retrieved from the database without performing necessary validation checks, such as path normalization or allowlisting. Additionally, the insert_record() AJAX handler allows an authenticated user to store an arbitrary value in the target 'location' column. When configured improperly, this vulnerability could be exploited even by lower-privileged users, making it critical for site owners to address this issue promptly.

References