EUVD-2026-107277
GHSA-fpp7-c629-jrj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach weForms endpoint over HTTP
-
DeliverySubmit path-traversal filename parameter
-
ExploitEscape restricted upload directory
-
ExecutionDelete arbitrary server file
-
ImpactDenial of service or site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target must be a WordPress site with the Bold Grid weForms plugin installed and active at version 1.6.28 or earlier. Exploitation abuses an unsanitized file-path parameter in a weForms file-handling routine to traverse outside the intended directory and delete arbitrary files. Per the supplied CVSS vector no authentication or user interaction is required (PR:N/UI:N), though this unauthenticated claim is not independently confirmed from the available data and may in practice require low-privilege (e.g., subscriber-level) access; the specific vulnerable endpoint and parameter are not disclosed in the provided description. |
| Impact | Signals are moderately consistent but incomplete. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated path traversal whose only impact is to availability - consistent with the referenced Patchstack title 'arbitrary file deletion.' No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation; this reads as a credible but not-yet-urgent HIGH rather than a proven in-the-wild threat. Note the CVSS impact profile is availability-only (C:N/I:N) even though arbitrary deletion of attacker-chosen files could plausibly carry integrity consequences - the scoring is conservative and may understate real-world impact (e.g., deleting wp-config.php can trigger WordPress re-installation takeover). Also note PR:N (unauthenticated) is asserted by the CVSS vector only; Patchstack-class WordPress plugin flaws frequently require at least subscriber/contributor authentication, so the unauthenticated claim should be verified against the Patchstack advisory before deprioritizing authentication-based mitigations. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to a weForms plugin endpoint on a WordPress site running version ≤1.6.28, supplying a traversal sequence (e.g., ../../) as a filename parameter. Because input is not restricted to the intended directory, the server deletes an arbitrary file outside the upload path, such as wp-config.php, causing denial of service or enabling a site-reinstallation takeover. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Path traversal in the Bold Grid weForms plugin for WordPress, affecting versions through 1.6.28, lets an attacker supply a crafted file-path parameter that escapes the intended directory and deletes arbitrary files on the underlying host, giving a primary availability impact (CVSS 7.5, C:N/I:N/A:H). Per the supplied CVSS vector the attack is network-reachable with no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), though that unauthenticated claim is not independently confirmed and the vulnerable endpoint and parameter are not disclosed in the available data; in practice lower-privileged access may be needed. No public exploit code and no CISA KEV entry were identified at time of analysis, and no fixed version is listed in the available references. Signals are moderately consistent but incomplete, so the practical exploitability and any auth prerequisite should be validated against the vendor's Patchstack advisory before prioritizing response.
RemediationAI
No vendor-released patch was identified at time of analysis - the advisory covers versions through 1.6.28 and no fixed version appears in the provided references, so confirm the current release and any patch status on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/weforms/vulnerability/wordpress-weforms-plugin-1-6-28-arbitrary-file-deletion-vulnerability?_s_id=cve) rather than assuming one exists. If the plugin is not essential, deactivate and remove it - the only complete mitigation, at the cost of losing its form functionality. If it must stay operational, deploy virtual patching at the WAF or reverse proxy that rejects traversal sequences (../, ..%2f, encoded and double-encoded variants, and absolute paths) in query strings and POST bodies targeting the plugin's endpoints, accepting the usual false-positive risk for legitimate filenames; restrict access to wp-admin/admin-ajax.php and the plugin's REST routes to known networks or authenticated roles, which may break public-facing form submissions; and harden the filesystem so the PHP process user cannot delete wp-config.php, core files, or backups (read-only mounts, immutable flags, off-box backups), which limits blast radius but can interfere with legitimate plugin updates and uploads. Because exploitation is destructive, enable file-integrity monitoring and alerting on deletions of core, configuration, or plugin files, and keep verified off-host backups so a successful arbitrary-file-deletion attack can be recovered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 path traversal in a WordPress plugin's file-handling routine. weForms is a drag-and-drop form builder that manages form submissions and associated file artifacts (uploads, temporary/export files) inside the WordPress uploads tree; the vulnerable code takes a caller-supplied pathname and operates on it without canonicalizing it (no normalization, no basename()/realpath() containment check, no rejection of '../' sequences) before passing it to a filesystem deletion call. Because the CPE string cpe:2.3:a:bold_grid:weforms:*:*:*:*:*:*:*:* carries a wildcard version, every release up to and including 1.6.28 should be treated as affected, and the plugin runs with the privileges of the WordPress PHP process, meaning the traversal can reach any file that the web server user can delete - including wp-config.php, core and plugin files, .htaccess, and uploaded content. With confidentiality and integrity scored as None, the intended consequence is denial of service through destructive file removal rather than data disclosure or tampering, which fits an arbitrary-file-deletion primitive reached by escaping the intended directory boundary. The specific route, AJAX action, or REST endpoint and the exact parameter name are not disclosed in the provided description, so defenders should review the plugin's file-handling code paths directly.
Know when Weforms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable low-complexity path traversal with arbitrary file deletion yields A:H and, per the advisory, no confidentiality/integrity impact; PR:N adopted from the source vector though not independently verified.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
Executive ViewAI
Bold Grid's weForms plugin for WordPress, in versions through 1.6.28, exposes affected sites to a high-severity path-traversal flaw that can allow an attacker to delete arbitrary files on the hosting server, with primary risk to website availability and operational continuity. No vendor-released patch identified at time of analysis, no public exploit identified at time of analysis, and no CISA KEV entry was identified; the available scoring indicates an unauthenticated network attack may be possible, though that prerequisite has not been independently confirmed. Leadership should prioritize inventory and mitigation because disruption to public-facing WordPress sites can translate directly into service outage, lost revenue, and recovery cost.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the Bold Grid weForms plugin (versions through 1.6.28) until a fixed version is released; if the plugin must remain active, restrict access to wp-admin and plugin functionality, deploy WAF rules to block path-traversal attempts, enforce least-privilege file permissions, maintain tested offline backups, and monitor for unexpected file deletion events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. Rated critical severity (CVSS 9.8), this vulnera
The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versi
Missing Authorization vulnerability in weForms.6.20. Rated critical severity (CVSS 9.1), this vulnerability is remotely
A PHP object injection vulnerability exists in BoldGrid weForms plugin through version 1.6.26 due to unsafe deserializat
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weForms weForms -
Exploit-DB