weForms CVE-2026-110253

Exploitation requires two distinct conditions. First, the attacker submits a weForms form entry containing an image/file-upload field whose stored attachment path is manipulated with directory-traversal sequences (the flaw is in weforms_delete_entry_attachments due to insufficient file-path validation, reachable via the class-field-image and class-ajax entry-deletion code paths). Second, and critically limiting, an administrator must PERMANENTLY delete that specific entry - not merely trash it - which is the action that triggers the unsafe deletion. Realistic limiting factors: the attack is fully dependent on authenticated admin interaction (UI:R), so it cannot be automated end-to-end by the attacker; impact is confined to deleting media files the web server process can unlink (no read, no execution, no exfiltration); and the plugin must be installed and accepting entries with file attachments. Mitigation also requires only upgrading to the fixed branch (1.6.29).

This is a genuine but moderate-priority issue, and the CVSS 5.4 (Medium) rating is well-calibrated rather than inflated. The provided vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L is internally consistent with the description: PR:N reflects that an unauthenticated attacker can submit the malicious form entry, while UI:R correctly captures the hard dependency on an administrator performing a permanent-delete action. Impact is deliberately limited (C:N, I:L, A:L) - this is arbitrary media-file deletion, not code execution, data theft, or site takeover. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The only intelligence source is Wordfence (the reporter), and a fix branch (1.6.29) exists on GitHub, indicating a patch is available. The practical risk ceiling is low-to-moderate: an attacker cannot act alone - success depends on social-engineering an admin into permanently deleting a poisoned entry - which is why this is a targeted/opportunistic nuisance rather than a wormable or mass-exploitable flaw. No conflicting signals were found between the CVSS vector and the description; both agree on remote submission plus required admin interaction.

An unauthenticated attacker submits a weForms contact-form entry crafted so its attachment file path contains traversal sequences pointing at an unrelated media file on the server. The submission is designed to look like spam, prompting an administrator to permanently delete the entry during routine moderation; that deletion invokes weforms_delete_entry_attachments, which fails to validate the path and removes the attacker-chosen media file instead. No public proof-of-concept is referenced in the provided data.