CVE-2026-111833: WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Q: Who can exploit this issue?

The vector is network-accessible, requires no privileges, and does not require user interaction. An unauthenticated remote attacker can exploit it if the affected functionality is reachable.

Q: What is the likely security impact?

The vulnerability is classified as path traversal leading to arbitrary file deletion. Its CVSS impact is availability-only, with no listed confidentiality or integrity impact.

Q: Which versions are affected?

weForms versions through 1.6.28 are affected. The available data does not identify a fixed version.

Published Oct 21, 2026

Updated

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.

Affected Software

1 affected component

Bold Grid weForms<=1.6.28

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress weForms plugin to a version that resolves this vulnerability.
Fixed in 1.6.29

Event History

Oct 21, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vector is network-accessible, requires no privileges, and does not require user interaction. An unauthenticated remote attacker can exploit it if the affected functionality is reachable.

What is the likely security impact?