WordPress Form Plugin Arbitrary File Deletion via Path Traversal

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Nex Forms Ultimate Form Builder Lite plugin for WordPress contains a critical arbitrary file deletion vulnerability affecting versions up to 9.2.3. The vulnerability stems from unsafe handling of file paths in the delete_file() AJAX handler, which retrieves user-controlled data from the database and passes it directly to PHP's unlink() function without validation, sanitization, or path constraints. An authenticated attacker can exploit the insert_record() AJAX handler to inject arbitrary file paths into the database, then trigger deletion of any file accessible to the web server process—including critical WordPress configuration files, plugins, themes, or even system files. This impacts any WordPress installation using this plugin, particularly those with multiple user roles or where account compromise occurs.

Casky's 351 mapped security skills leverage Claude's extended reasoning to detect the attack chain across MITRE ATT&CK techniques TA0001 (Initial Access/Reconnaissance) and TA0007 (Discovery/Collection). Practitioners using Casky would identify suspicious patterns: AJAX requests to insert_record() followed by delete_file() calls with path traversal sequences (../, ..\ patterns); database queries storing unexpected file paths in the 'location' column; and unlink() function calls operating on files outside intended directories. The platform's skill mapping would flag CWE-22 path traversal indicators—such as insufficient input validation, missing basename() or realpath() checks, and direct file system operations on user-influenced data—within WordPress plugin code analysis. Security teams would see findings correlating database modifications with subsequent file system access attempts, revealing the two-stage exploitation pattern before actual file deletion occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15450.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-15450

Casky has 351 skills that investigate the attack patterns behind CVE-2026-15450. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn