CVE-2026-15382: WPBakery Ultimate Addons Auth Bypass Flaw

CVE-2026-15382 Overview

CVE-2026-15382 affects the Ultimate Addons for WPBakery Page Builder WordPress plugin in versions prior to 3.21.4. The plugin fails to perform capability or nonce checks before deleting a site's custom-uploaded icon font packs. Unauthenticated attackers can send a single HTTP request to permanently delete every custom icon font on a target site. The flaw represents a broken access control weakness [CWE-862] combined with missing cross-site request forgery protection [CWE-352]. Successful exploitation causes visible content breakage, loss of design assets, and potential downstream layout failures across pages that reference the deleted icon fonts.

Critical Impact
Unauthenticated attackers can permanently delete all custom icon font packs on a vulnerable WordPress site with a single HTTP request, causing irreversible data loss and site content damage.

Affected Products

Ultimate Addons for WPBakery Page Builder (WordPress plugin) versions before 3.21.4
WordPress installations using this plugin with custom-uploaded icon font packs
Sites relying on the plugin's icon font management functionality

Discovery Timeline

2026-07-30 - CVE-2026-15382 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15382

Vulnerability Analysis

The vulnerability resides in the plugin's icon font pack deletion handler. The handler executes deletion logic without verifying that the requester holds an appropriate WordPress capability such as manage_options. It also omits a WordPress nonce verification step that would confirm the request originated from an authorized administrative context. Any anonymous visitor can invoke the endpoint directly and trigger the deletion routine. The affected functionality targets custom icon font packs previously uploaded by site administrators through the plugin's interface. The deletion is destructive and does not require confirmation or authenticated context, so attackers do not need reconnaissance or credential harvesting to succeed.

Root Cause

The root cause is missing authorization enforcement on a state-changing AJAX or admin action endpoint. WordPress plugins are expected to gate destructive operations with current_user_can() checks and check_ajax_referer() or wp_verify_nonce() calls. Ultimate Addons for WPBakery Page Builder omits both controls on the icon font deletion path. This design flaw allows the endpoint to accept unauthenticated requests and perform file or database deletions on behalf of any caller.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker crafts an HTTP request to the vulnerable endpoint exposed by the plugin and submits it without credentials. The server processes the request and removes the associated icon font pack records and assets. Attackers can automate mass deletion across many sites by scanning for the plugin and iterating through predictable identifiers. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-15382

Indicators of Compromise

Unexpected disappearance of custom icon font packs from the plugin's admin interface
Broken icon rendering, missing glyphs, or fallback squares across published pages
HTTP POST requests to WordPress admin-ajax.php referencing icon font deletion actions from unauthenticated sources
Access log entries showing requests to the plugin's deletion endpoints without a valid wp-admin referrer or authentication cookie

Detection Strategies

Review web server access logs for anonymous requests targeting the plugin's AJAX action names, particularly those containing keywords such as delete, icon, or font
Correlate WordPress database changes and file system deletions under wp-content/uploads/ icon font directories with request source IP addresses
Compare current icon font pack inventories against known-good backups to detect unauthorized removals

Monitoring Recommendations

Alert on high-frequency POST requests to admin-ajax.php from single source addresses lacking valid authentication cookies
Monitor plugin file directories for unexpected deletion events using file integrity monitoring
Track WordPress plugin version inventories to identify hosts still running vulnerable releases prior to 3.21.4

How to Mitigate CVE-2026-15382

Immediate Actions Required

Update Ultimate Addons for WPBakery Page Builder to version 3.21.4 or later on all WordPress installations
Take a complete backup of wp-content/uploads/ and the WordPress database before applying the update to preserve icon font data
Audit recent site content and admin interfaces to confirm no icon font packs have already been deleted

Patch Information

Upgrade the plugin to version 3.21.4 or higher, which introduces the missing capability and nonce checks on the icon font deletion handler. Refer to the WPScan Vulnerability Report for the fixed version details.

Workarounds

Deactivate the Ultimate Addons for WPBakery Page Builder plugin until the update to 3.21.4 can be applied
Deploy a web application firewall rule that blocks unauthenticated POST requests to the plugin's icon font deletion AJAX action
Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible, or require authentication at the reverse proxy layer

bash

# Example WAF rule concept blocking unauthenticated icon font deletion requests
# Adjust action parameter name based on plugin source review
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1015382,msg:'Block unauth Ultimate Addons icon font deletion'"
  SecRule ARGS:action "@rx (?i)(delete.*icon.*font|remove.*icon.*pack)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"