CVE-2026-110253

MediumCVSS 5.4

Published: 17/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The weForms plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to and including 1.6.28. Unauthenticated attackers can delete arbitrary media files on the server, requiring an administrator to permanently delete the poisoned form entry.

Risk Assessment

An attacker can delete arbitrary media files, potentially leading to data loss or site disruption.

Recommendation

Update the weForms plugin to a version later than 1.6.28 that includes the file path validation fix.

Other vulnerabilities in weForms

CVE-2025-69028Medium
A missing authorization vulnerability in the BoldGrid weForms plugin (versions up to and including 1.6.25) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions they should not have permission to do.

Original NVD description (English source)

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS