What is the CVSS score of CVE-2026-15450?

CVE-2026-15450 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Nex Forms Plugin are affected by CVE-2026-15450?

The Nex Forms WordPress plugin (versions ≤9.2.3) contains a critical file deletion vulnerability that allows authenticated attackers to delete any file on the server, including wp-config.php,…

How to fix or mitigate CVE-2026-15450?

Within 24 hours: Disable the Nex Forms plugin immediately and verify that critical files (particularly wp-config.php) have not been deleted. Within 7 days: Conduct a complete audit of file access logs and review which users have access to the plugin; contact the vendor to confirm patch timeline and evaluate alternative form builder plugins. Within 30 days: Either update to a patched version of Nex Forms (once released) or migrate to a hardened alternative with proper input validation.

Nex Forms Plugin CVE-2026-15450

EUVD-2026-51758 HIGH

Path Traversal (CWE-22)

2026-08-01 Wordfence

GHSA-2446-gfm3-96v2

WordPress Path Traversal Wordpress Plugin Nex Forms Ultimate Forms Plugin For Wordpress Webaways

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.5 MEDIUM

Admin-level access required by default configuration, warranting PR:H; no confidentiality impact since unlink() deletes rather than reads files.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:52 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

HIGH 8.1

DescriptionCVE.org

The Nex Forms - Ultimate Form Builder - Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.

AnalysisAI

Arbitrary file deletion via path traversal in the Nex Forms - Ultimate Form Builder - Lite WordPress plugin (versions up to and including 9.2.3) allows authenticated attackers to delete any file on the server, including the critical wp-config.php. The flaw stems from a two-stage attack chain: the insert_record() AJAX handler accepts unsanitized file paths (wp_kses() strips only HTML, not traversal sequences) into a database column, which the delete_file() AJAX handler then passes directly to PHP's unlink() without realpath(), basename(), or allowlist validation. By default this requires admin-level access, but the plugin's configurable user-level option may reduce the privilege requirement to lower roles. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.

Technical ContextAI

The vulnerability exists in the Nex Forms - Ultimate Form Builder - Lite plugin by Webaways (CPE: cpe:2.3:a:webaways:nex-forms_-_ultimate_forms_plugin_for_wordpress:*:*:*:*:*:*:*:*), a WordPress form-building plugin. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), manifesting in two cooperating PHP AJAX handlers located in includes/classes/class.db.php. At line 269/273, insert_record() accepts user-supplied data and stores it in the 'location' column of a WordPress database table; the only sanitization applied is wp_kses(), which is designed to strip HTML tags and attributes but provides no protection against path traversal sequences (e.g., ../../) or absolute filesystem paths. At line 805, delete_file() fetches the stored path from the database and passes it directly to PHP's unlink() with no secondary validation - no call to realpath() to canonicalize the path, no basename() to strip directory components, and no allowlist restricting deletions to a permitted upload directory. Because WordPress AJAX handlers are accessible over HTTP to authenticated users, the full attack is network-reachable.

RemediationAI

Update the Nex Forms - Ultimate Form Builder - Lite plugin immediately to the version reflecting changeset 3625615 or later via the WordPress plugin repository - verify the installed version is newer than 9.2.3, as the exact patched release version is not confirmed from available intelligence. Until patched, administrators should restrict access to the WordPress admin dashboard to trusted users only and audit current plugin user-level permission settings to ensure lower-privilege roles cannot invoke the plugin's AJAX handlers. As a compensating control, consider using a WordPress security plugin (e.g., Wordfence) to monitor and block anomalous unlink() or AJAX activity, though this does not eliminate the root cause. If the plugin cannot be updated immediately, deactivating it eliminates the attack surface at the cost of losing form-builder functionality. Reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5c8cb3-df67-4f2c-869a-48e34f5619ff for updated patch confirmation.