HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-15450 — The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable ...

·Source: NIST NVD

Updated:

Executive Summary

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX han

Analysis

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges. CVSS Score: 8.1. Published: 2026-08-01T09:16:59.023.

Indicators of Compromise (1)

CVE (1)
CVE-2026-15450
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 1, 2026. Verified by: NIST.

Related Threats

LOWVulnerability

HollowFrame Loader Uses Fake Python DLL to Evade Defender

New HollowFrame loader hid Go code in a fake Python DLL after pre-staging Defender exclusions

Infosecurity Magazine
MEDIUMVulnerability

BBVA acquires SocGen's 50% stake in brokerage joint venture Altura Markets

BBVA has reached an agreement with Société Générale (SG) to integrate Altura Markets into the BBVA Group by acquiring the 50 percent stake currently owned by the French bank, becoming the company's sole shareholder. The transaction is subject to the relevant regulatory approvals.

Finextra
MEDIUMVulnerability

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit. "

The Hacker News