Ultimate Addons WPBakery CVE-2026-15382

No authentication, session token, or special site configuration is required - CVSS PR:N and AC:L confirm the deletion endpoint is reachable by any unauthenticated network attacker against any WordPress site running Ultimate Addons for WPBakery Page Builder before version 3.21.4. The one natural limiting factor is impact scope: sites with no custom icon font packs uploaded experience no meaningful effect beyond an empty deletion operation. The attack does not grant code execution, file write capability, credential disclosure, or persistent access - exploitation is bounded to destruction of custom icon font assets. No specific platform, non-default configuration, or user interaction is required.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) captures a network-exploitable, zero-authentication, low-complexity attack with bounded impact: permanent loss of custom icon fonts degrades site integrity and breaks visual elements dependent on those fonts, but does not yield code execution or credential access. SSVC reinforces urgency on automatable coverage: the attack requires no setup, scales trivially across all unpatched instances, and a public proof-of-concept lowers the skill threshold to near zero. However, EPSS at 0.15% (5th percentile) indicates exploitation has not materialized at scale as of this analysis, consistent with the narrow, non-critical impact class. The vulnerability is not listed in CISA KEV. Real-world priority should be elevated for sites with significant custom icon branding investments where deletion would cause visible disruption, but this is not a systemic compromise path. Note: the source tag 'Information Disclosure' appears to be a misclassification - the actual impact is unauthorized data destruction with no confidentiality dimension confirmed by the CVSS vector (C:N).

An attacker performs mass scanning for WordPress sites bearing fingerprints of the WPBakery ecosystem, then issues a single crafted HTTP POST request to the WordPress AJAX endpoint targeting the unprotected icon font deletion action - no session cookie, authentication token, or CSRF nonce required. All custom-uploaded icon font packs are permanently deleted in one round trip, visually breaking branding elements across the site until fonts are manually re-uploaded by an administrator. A public proof-of-concept demonstrating this single-request technique is documented via WPScan.