Junglewise Threat Intelligence

CVE-2026-15450: Webaways NEX-Forms Lite arbitrary file deletion via path traversal

CVE-2026-15450 · Severity: high · CVSS 8.1 · Published 2026-08-01

Executive brief

The NEX-Forms Lite plugin for WordPress, used for building website forms, contains a security flaw that allows authorized users to delete files from the web server. By exploiting this vulnerability, an attacker could delete critical system files like the WordPress configuration file, potentially leading to a complete site shutdown or takeover. While typically requiring administrative access, certain plugin configurations could allow lower-level users to perform this action.

Technical details

A path traversal vulnerability exists in the NEX-Forms Lite plugin due to insufficient validation in the delete_file() AJAX handler. The handler retrieves a file path from the database and passes it directly to the PHP unlink() function without sanitization (such as realpath() or basename() checks). An attacker can use the insert_record() AJAX handler to store an arbitrary file path in the 'location' column, as the wp_kses() function used for filtering only strips HTML tags and does not block path traversal sequences. This enables authenticated users, typically with administrator privileges (or lower depending on plugin settings), to delete arbitrary files on the server.

Affected products

  • webaways NEX-Forms – Ultimate Forms Plugin for WordPress (Lite) <= 9.2.3

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References