CVE-2026-110253 Overview
The weForms – Easy Drag & Drop Contact Form Builder plugin for WordPress contains a path traversal weakness [CWE-22] that enables arbitrary media file deletion. The flaw resides in the weforms_delete_entry_attachments function and affects all versions up to and including 1.6.28. Unauthenticated attackers can submit crafted form entries that reference arbitrary file paths on the server. When an administrator later permanently deletes the poisoned entry, the plugin removes the attacker-specified media files. Spam-looking submissions provide a natural social engineering lure for triggering that moderation action.
Critical Impact
Unauthenticated attackers can cause deletion of arbitrary media files on vulnerable WordPress sites once an administrator removes a poisoned form entry.
Affected Products
- weForms – Easy Drag & Drop Contact Form Builder for WordPress
- All plugin versions through 1.6.28
- Fixed in weForms 1.6.29
Discovery Timeline
- 2026-10-17 - CVE-2026-110253 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-110253
Vulnerability Analysis
The vulnerability is a path traversal issue [CWE-22] in the weForms plugin's attachment handling logic. The weforms_delete_entry_attachments function processes attachment references stored with a form entry and deletes the referenced files when the entry is permanently removed. Because the function performs insufficient validation on the stored file paths, an attacker-controlled entry can reference files outside the intended uploads scope. The attack vector is network-based and requires no authentication, but execution depends on an administrator performing a routine moderation step.
Root Cause
The root cause is missing or inadequate normalization and allow-list validation of file paths passed to the deletion routine. The relevant logic in weForms 1.6.28 is referenced across includes/class-ajax.php (lines 627, 711, and 1056), includes/fields/class-field-image.php (line 138), and includes/functions.php (line 362). These code paths accept attachment metadata originating from form submissions and feed it into deletion operations without constraining the target to legitimate entry attachments.
Attack Vector
An unauthenticated attacker submits a form entry whose attachment metadata references a sensitive media file path on the server. The submission is crafted to appear as spam, prompting an administrator to use the "permanently delete" moderation action. When the entry is purged, weforms_delete_entry_attachments removes the attacker-specified media file. Successful exploitation can delete images or other media supporting site functionality, resulting in limited integrity and availability impact.
No verified exploit code is publicly available. See the Wordfence Vulnerability Analysis and the WordPress Trac Ajax Class - Line 1056 for the vulnerable code path.
Detection Methods for CVE-2026-110253
Indicators of Compromise
- Unexpected deletion of media files from the WordPress uploads directory not tied to administrator-initiated media library actions.
- weForms entries containing attachment metadata with traversal sequences such as ../ or absolute file paths outside the entry attachments scope.
- Spam-styled form submissions that include attachment field values pointing at known site assets.
Detection Strategies
- Inspect weForms entry records stored in the database for attachment fields referencing paths outside the plugin's expected uploads subdirectory.
- Review PHP error logs and web server logs for file deletion operations following admin-ajax.php requests invoking weForms entry deletion actions.
- Compare the wp-content/uploads directory against known-good inventories to identify missing media files.
Monitoring Recommendations
- Enable file integrity monitoring on wp-content/uploads and alert on unexpected delete events.
- Alert on administrator deletion of weForms entries that contain attachment metadata referencing paths with traversal characters.
- Audit the plugin version across all WordPress sites and flag any installation at 1.6.28 or earlier.
How to Mitigate CVE-2026-110253
Immediate Actions Required
- Upgrade weForms to version 1.6.29 or later on every affected WordPress site.
- Instruct administrators to avoid using "permanently delete" on suspicious weForms entries until the plugin is patched.
- Back up the wp-content/uploads directory before performing any entry moderation on vulnerable installations.
Patch Information
The maintainers addressed the vulnerability in weForms 1.6.29. Release details and source are available in the GitHub WeForms Repository. Review the Wordfence Vulnerability Analysis for additional remediation context.
Workarounds
- Disable the weForms plugin until the upgrade to 1.6.29 can be completed.
- Restrict the admin-ajax.php endpoints associated with weForms entry deletion using a web application firewall rule that blocks requests containing path traversal patterns.
- Train administrators to send suspected spam entries to trash rather than invoking permanent deletion on vulnerable versions.
# Configuration example: verify the installed weForms version via WP-CLI
wp plugin get weforms --field=version
wp plugin update weforms --version=1.6.29
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
