THREAT OPS › Threat News › [NVD] CVE-2026-15450 (HIGH 8.1) — The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to
[NVD] CVE-2026-15450 (HIGH 8.1) — The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to
CVE-2026-15450 CVSS: 8.1 HIGH Published: 2026-08-01T09:16:59.023
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(
MITRE ATT&CK techniques
- File DeletionT1070.004
Indicators of compromise
- CVE-2026-15450cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-15450