CVE-2026-110253: weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.
Affected Software
Event History
Frequently Asked Questions
What must happen for exploitation to succeed?
An unauthenticated attacker must submit a poisoned form entry and persuade or otherwise cause an administrator to permanently delete that entry. The deletion occurs during this administrator action, so exploitation requires user interaction.
Are sites running the plugin's affected versions exposed by default?
Any installation using weForms version 1.6.28 or earlier is affected. Exploitation depends on the site accepting attacker-controlled form submissions and an administrator permanently deleting the poisoned submission.
What is the practical impact of a successful exploit?
An attacker can delete arbitrary media files on the server through insufficient validation of the wpuf_files parameter. The stated impact is limited to media-file deletion; no confidentiality impact is identified.
What can administrators do while patching is unavailable?
Avoid permanently deleting suspicious weForms entries, particularly spam-like submissions, until the plugin can be updated. Review form submissions before deletion because the vulnerable action is triggered when an administrator permanently deletes a poisoned entry.