Weforms Easy Drag Drop Contact Form Builder For Wordpress
Monthly
Arbitrary media file deletion in the weForms WordPress plugin (all versions through 1.6.28) lets an unauthenticated attacker poison a form entry's image-upload attachment path with directory-traversal sequences and then persuade an administrator to permanently delete that entry, at which point the plugin unlinks whatever file the traversed path resolves to. The CVSS 5.4 (Medium) score is well-calibrated: the attacker never gains read, execution, or exfiltration capability, impact is limited to files the web server process can unlink, and the mandatory administrator interaction (UI:R) makes end-to-end automation impossible. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical risk concentrates on sites that accept file-upload entries and routinely hard-delete spam-looking submissions.
Arbitrary media file deletion in the weForms WordPress plugin (all versions through 1.6.28) lets an unauthenticated attacker poison a form entry's image-upload attachment path with directory-traversal sequences and then persuade an administrator to permanently delete that entry, at which point the plugin unlinks whatever file the traversed path resolves to. The CVSS 5.4 (Medium) score is well-calibrated: the attacker never gains read, execution, or exfiltration capability, impact is limited to files the web server process can unlink, and the mandatory administrator interaction (UI:R) makes end-to-end automation impossible. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical risk concentrates on sites that accept file-upload entries and routinely hard-delete spam-looking submissions.