CVE-2026-15450
Received Received - Intake

Arbitrary File Deletion in Nex Forms WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15450
EUVD
EUVD-2026-51758

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbeaverbuilder nex_forms_ultimate_form_builder_lite to 9.2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Nex Forms WordPress plugin allows authenticated attackers with admin-level access or higher to delete arbitrary files on the server by exploiting path traversal. The plugin's delete_file() function processes file paths without proper validation, enabling deletion of critical files like wp-config.php.

Detection Guidance

Check if the Nex Forms – Ultimate Form Builder – Lite plugin version 9.2.3 or lower is installed on your WordPress site. Look for unauthorized file deletions or suspicious activity in server logs.

Impact Analysis

An attacker could delete important files on your WordPress site, including configuration files, leading to site downtime, data loss, or complete site compromise. Even with lower user privileges, if the plugin's settings allow, attackers might exploit this to cause significant damage.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file deletion, potentially exposing or destroying sensitive data. Loss of configuration files or logs may violate data integrity and security requirements mandated by these regulations.

Mitigation Strategies

Update the Nex Forms plugin to the latest version immediately. Remove admin-level access for untrusted users. Monitor server files for unauthorized changes and restrict file deletion permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart