CVE-2026-15450 Overview
CVE-2026-15450 is a path traversal vulnerability [CWE-22] in the Nex Forms – Ultimate Form Builder – Lite plugin for WordPress, affecting all versions up to and including 9.2.3. The flaw resides in the delete_file() AJAX handler, which retrieves a file path from the database and passes it directly to unlink() without validation. A companion insert_record() AJAX handler lets authenticated users store arbitrary values in the location column, since wp_kses() only strips HTML tags. Authenticated attackers with admin-level access can delete arbitrary files on the server, including wp-config.php, potentially leading to site takeover.
Critical Impact
Deletion of wp-config.php triggers the WordPress installation flow, allowing an attacker to connect the site to a database they control and achieve remote code execution.
Affected Products
- Nex Forms – Ultimate Form Builder – Lite plugin for WordPress
- All versions up to and including 9.2.3
- WordPress installations where the plugin's user-level option permits lower-privileged roles
Discovery Timeline
- 2026-08-01 - CVE-2026-15450 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-15450
Vulnerability Analysis
The vulnerability exists in the plugin's database class (class.db.php) which exposes two AJAX endpoints that together create the arbitrary file deletion primitive. The insert_record() handler accepts a caller-supplied location value and persists it to the database after passing it through wp_kses(). Because wp_kses() is designed to sanitize HTML rather than filesystem paths, sequences such as ../ and absolute paths pass through untouched.
The delete_file() handler then reads the stored location value and passes it directly to PHP's unlink() function. The handler performs no canonicalization with realpath(), no base-name extraction with basename(), and does not restrict deletion targets against an allowlist. This allows the attacker-controlled string to reference any file the PHP process user can access.
Root Cause
The root cause is missing path validation on data flowing from an authenticated write endpoint to a filesystem delete operation. The plugin treats the database-stored location value as trusted despite it being fully controlled by the same authenticated user who triggers the deletion. Sanitization was applied for the wrong threat model — HTML injection rather than path traversal.
Attack Vector
An attacker authenticated with administrator privileges submits an insert_record() AJAX request populating the location column with a traversal string such as ../../../../wp-config.php. A subsequent delete_file() AJAX call causes the plugin to resolve that stored value and invoke unlink() against the target. Deleting wp-config.php forces WordPress into the initial setup state, from which an attacker can point the site at a database they control and execute arbitrary PHP. When the plugin's user-level option is loosened, exploitation is possible from lower-privileged accounts.
See the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report for source-level references.
Detection Methods for CVE-2026-15450
Indicators of Compromise
- Missing or truncated wp-config.php file, or unexpected reappearance of the WordPress /wp-admin/setup-config.php installer.
- POST requests to admin-ajax.php invoking the Nex Forms insert_record and delete_file actions in close succession from the same authenticated session.
- Presence of path traversal sequences (../, absolute paths) in the location column of Nex Forms plugin tables.
- Unexpected deletion of PHP files under wp-content/, wp-includes/, or the WordPress root.
Detection Strategies
- Audit web server access logs for admin-ajax.php requests matching the plugin's AJAX action names originating from administrator sessions.
- Query the plugin's database tables for location values containing .., leading slashes, or filesystem paths outside expected upload directories.
- Compare file inventories against known-good baselines to identify unauthorized deletions of core WordPress files.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress document root, with priority alerts on deletion of wp-config.php and core .php files.
- Forward WordPress and PHP-FPM logs to a central SIEM and alert on unlink()-related errors or repeated setup-config.php accesses.
- Track administrator-role account activity for anomalous AJAX call patterns targeting form-builder plugins.
How to Mitigate CVE-2026-15450
Immediate Actions Required
- Update the Nex Forms – Ultimate Form Builder – Lite plugin to a version newer than 9.2.3 as soon as a patched release is available from the vendor.
- Restrict administrator access to trusted personnel and enforce strong authentication, including multi-factor authentication, for all privileged WordPress accounts.
- Review the plugin's user-level option and set it to the highest role required, preventing lower-privileged users from reaching the vulnerable AJAX handlers.
- Back up wp-config.php and the WordPress database, and verify restore procedures before applying changes.
Patch Information
The vendor addressed the issue in the plugin repository. Review the WordPress Plugin Changeset for the corrective code changes and upgrade to the fixed release published on the WordPress plugin directory.
Workarounds
- Deactivate and remove the Nex Forms – Ultimate Form Builder – Lite plugin until a patched version is installed.
- Apply a web application firewall rule blocking admin-ajax.php requests whose parameters contain ../ or absolute filesystem paths targeting the Nex Forms actions.
- Set restrictive filesystem permissions so the PHP process cannot delete wp-config.php or files outside the plugin's expected working directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
