CVE-2026-110253

MEDIUM 5.4

weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.

CWE	CWE-22
Vendor	boldgrid
Product	weforms – easy drag & drop contact form builder for wordpress
Published	Oct 17, 2026

Stay Ahead of the Next One

Get instant alerts for boldgrid weforms – easy drag & drop contact form builder for wordpress

Be the first to know when new medium vulnerabilities affecting boldgrid weforms – easy drag & drop contact form builder for wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

boldgrid / weForms – Easy Drag & Drop Contact Form Builder For WordPress

0 ≤ 1.6.28

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Kuba