CVE-2026-15450

Name of the Vulnerable Software and Affected Versions Nex Forms – Ultimate Form Builder – Lite versions prior to 9.2.4

Description An arbitrary file deletion issue exists due to path traversal. The delete file() AJAX handler retrieves a file path from the database and passes it to the unlink() function without validation, such as realpath(), basename(), or an allowlist check. Simultaneously, the insert record() AJAX handler allows authenticated users to store arbitrary values in the location column, as wp kses() only removes HTML tags and does not prevent path traversal or absolute paths. This allows authenticated attackers with admin-level access or higher to delete arbitrary files on the server, including the wp-config file. Depending on the plugin's user-level configuration, this may be exploitable by users with lower privileges.

Recommendations Update to a version newer than 9.2.3.