Arbitrary File Deletion in Nex Forms Plugin for WordPress

The Nex Forms - Ultimate Form Builder - Lite plugin for WordPress (versions 9.2.3 and below) contains a critical path traversal vulnerability that enables arbitrary file deletion. The vulnerability exists within two specific AJAX handlers: insert_record() and delete_file(). The insert_record() function fails to validate input before storing it in the database, allowing an attacker to inject malicious file paths. The delete_file() function then retrieves this unsanitized path and passes it directly to the PHP unlink() function without performing path normalization, basename validation, or allowlist checks.

This flaw allows authenticated users - typically those with administrative privileges, though potentially lower depending on plugin configuration - to delete arbitrary files on the underlying web server. Successful exploitation can result in the deletion of critical WordPress files such as wp-config.php, which effectively forces a site re-installation or results in a complete denial of service. The vulnerability highlights the danger of passing user-supplied input directly to filesystem-modifying functions.

Impact

Successful exploitation allows for the deletion of critical server files. In the context of a WordPress environment, the deletion of the wp-config.php file removes database connection settings, causing the site to become inaccessible and potentially allowing an attacker to initiate a fresh installation or redirect the site traffic. This poses a high risk to availability and system integrity for organizations relying on this plugin.

Recommendation

• Update the Nex Forms - Ultimate Form Builder - Lite plugin to the latest version immediately to patch CVE-2026-15450.
• Audit the WordPress plugin directory and remove any plugins that are not actively maintained or required for business operations.
• Implement restrictive file system permissions on the web server to ensure that the web service user (e.g., www-data) cannot delete critical configuration or system files outside of designated upload directories.
• Review WordPress access logs for anomalous POST requests directed at the plugin's AJAX endpoints if indicators of compromise are suspected.