CVE-2026-111833

Deferred Deferred - Pending Action

Path Traversal in Bold Grid weForms

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Patchstack

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-111833

EUVD

EUVD-2026-107277

Affected Vendors & Products

Vendor	Product	Version / Range
Bold Grid	weForms	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a Path Traversal vulnerability in the Bold Grid weForms plugin for WordPress. It allows attackers to delete critical files on a website without authentication, potentially breaking the site. The flaw exists in versions 1.6.28 and below.

Detection Guidance

Detecting this vulnerability requires checking the installed version of the weForms plugin. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin directory for version details. Look for versions 1.6.28 or below.

Impact Analysis

An attacker could exploit this to delete important files on your website, causing it to malfunction or become unavailable. Since no authentication is required, any unpatched version is at risk of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially compromising sensitive data storage or processing systems. For GDPR, it may violate integrity requirements (Article 32) if personal data is affected. For HIPAA, it could impact the availability of protected health information, violating Security Rule standards.

Mitigation Strategies

Immediately update the weForms plugin to version 1.6.29 or later. If updating is not possible, seek assistance from a hosting provider or web developer. No specific mitigation rules can be applied due to the vulnerability's nature.

Hi! I’m here to help you understand CVE-2026-111833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...