Executive brief
A vulnerability in the Ultimate Addons for WPBakery Page Builder plugin for WordPress allows unauthorized individuals to delete custom icon fonts from a website. By sending a simple web request, an attacker can permanently remove these design assets without needing to log in. This can disrupt the website's appearance and require administrators to manually restore or re-upload the missing font files.
Technical details
The vulnerability is an unauthenticated arbitrary file deletion flaw within the 'delete-bsf-fonts' functionality. The plugin fails to implement proper authorization (capability checks) or CSRF protection (nonces) on the routine responsible for managing custom icon font packs. An attacker can trigger this deletion by sending a GET request to any site page with the 'delete-bsf-fonts=1' parameter. This results in the recursive deletion of custom font packs from the uploads directory and a reset of the 'smile_fonts' database option. The issue is fixed in version 3.21.4.
Affected products
- Brainstorm Force Ultimate Addons for WPBakery Page Builder < 3.21.4
Timeline
- 2026-07-10: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: Published to NVD
- 2026-07-30: patched: Fixed in version 3.21.4