What is the CVSS score of CVE-2026-15382?

CVE-2026-15382 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-15382?

Yes, a public proof-of-concept exploit is available for CVE-2026-15382. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-15382?

Yes, a patch is available for CVE-2026-15382. Update the affected software to the latest version immediately.

Ultimate Addons WPBakery CVE-2026-15382

EUVD-2026-51001 MEDIUM

External Control of File Name or Path (CWE-73)

2026-07-30 WPScan

GHSA-2rxq-q8qw-7pgp

WordPress Information Disclosure Ultimate Addons For Wpbakery Page Builder Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint requires no privileges; integrity and availability both low as only custom icon font assets are destroyed with no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:31 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.

AnalysisAI

Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.4. The plugin's icon font deletion endpoint performs no WordPress capability check and no nonce verification, meaning any unauthenticated HTTP request can permanently erase every custom-uploaded icon font pack on an affected site in a single request. A publicly available proof-of-concept exists and SSVC assesses the attack as automatable, though EPSS remains very low at 0.15% (5th percentile), indicating no significant observed exploitation at scale; the vulnerability is absent from CISA KEV.

Technical ContextAI

The affected product is a WordPress plugin (CPE: cpe:2.3:a:unknown:ultimate_addons_for_wpbakery_page_builder:*:*:*:*:*:*:*:*) that extends WPBakery Page Builder with supplementary design elements including custom icon font pack management. WordPress security conventions require all sensitive administrative actions to be gated behind both a capability check (e.g., current_user_can()) to verify user authority and a nonce to prevent cross-site request forgery. CWE-73 (External Control of File Name or Path) applies because the deletion routine processes externally supplied input identifying icon font resources and acts on them without verifying the requestor's identity or authorization - effectively allowing any unauthenticated actor to externally direct the server to erase stored font assets. The vulnerability class combines missing authorization and missing CSRF protection on a destructive file-management endpoint.

RemediationAI

Update the Ultimate Addons for WPBakery Page Builder plugin to version 3.21.4 or later immediately; this is the vendor-confirmed patched release introducing the missing capability and nonce checks on the icon font deletion endpoint. Update via the WordPress plugin dashboard or directly from the plugin vendor. For sites that cannot patch immediately, a compensating control is to block unauthenticated POST requests to wp-admin/admin-ajax.php at the WAF or web server layer specifically for the icon font deletion action parameter - however, blanket restriction of admin-ajax.php for unauthenticated users may break other plugin functionality and requires careful action-parameter scoping to avoid collateral impact. Alternatively, temporarily deactivating the Ultimate Addons for WPBakery plugin entirely eliminates the attack surface with the trade-off of losing all plugin-provided design elements. Advisory reference: https://wpscan.com/vulnerability/54e94f13-758d-4e05-9993-c72ea270e216/