CVE-2026-15382
Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts
CVSS Score
6.5
EPSS Score
0.2%
EPSS Percentile
5th
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
| Vendor | unknown |
| Product | ultimate addons for wpbakery page builder |
| Published | Jul 30, 2026 |
| Last Updated | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ultimate addons for wpbakery page builder
Be the first to know when new medium vulnerabilities affecting unknown ultimate addons for wpbakery page builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Ultimate Addons for WPBakery Page Builder
0 < 3.21.4
References
Credits
Trần Tiến WPScan