NEX-Forms database paths permit arbitrary server-file deletion
NEX-Forms through 9.2.3 lets an authorized user store an arbitrary location value through insert_record(); delete_file() later retrieves that value and passes it directly to unlink() without path validation. Administrators, or lower roles when the plugin's user-level option permits them, can traverse to and delete arbitrary files such as wp-config.php.
- Component
- NEX-Forms – Ultimate Forms Plugin for WordPress
- Plugin slug
nex-forms-express-wp-form-builder- Affected
- <= 9.2.3
- Safe version
> 9.2.3- Published
- Aug 01, 2026
This CVE was published Aug 01, 2026 and is one of 34 known issues for this plugin.
Update, patch or deactivate.
Update to a corrected release after 9.2.3. Review plugin records for absolute or traversing location values, restore deleted files from trusted copies, and investigate the site if configuration files were removed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H