CVE-2026-15450 webaways CVE debrief

Who should care

Administrators of WordPress sites using the Nex Forms – Ultimate Form Builder – Lite plugin, especially those with admin-level access and above, should be aware of the potential for arbitrary file deletion. They should review access controls, monitor for suspicious activity, and apply vendor remediation when available.

Technical summary

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation, combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column.

Defensive priority

Authenticated attackers with admin-level access and above can delete arbitrary files on the affected site's server.

Recommended defensive actions

• Inventory vulnerable installations of the Nex Forms – Ultimate Form Builder – Lite plugin for WordPress.
• Apply vendor remediation when available.
• Monitor for suspicious file deletion activity.
• Implement compensating controls, such as restricting access to sensitive files.
• Review access controls for the plugin's user-level option.
• Track exceptions and retest remediated assets.
• Close the item only after evidence is documented.

Evidence notes

The vulnerability exists due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation. This issue allows authenticated attackers with admin-level access and above to delete arbitrary files on the affected site's server, including wp-config. Evidence is limited to public sources and vendor disclosures. Defenders should verify affected installations, review access controls, and monitor for suspicious file deletion activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.