CVE-2026-110253: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress

CVE-2026-110253 is a path traversal vulnerability (CWE-22) in the weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin. The flaw exists in the weforms_delete_entry_attachments function, where insufficient validation of file paths allows unauthenticated attackers to delete arbitrary media files on the server. Exploitation requires that an administrator performs a permanent deletion of a maliciously crafted form entry, which attackers can prompt via social engineering tactics. All versions up to and including 1.6.28 are affected.

An attacker can cause denial of availability of media files by deleting arbitrary files on the server. This can disrupt website functionality or cause data loss. However, exploitation requires social engineering to trick an administrator into deleting a malicious form entry, limiting the attack vector to scenarios involving administrator interaction.

No official patch or fix is currently documented. Administrators should exercise caution when deleting form entries, especially those that appear suspicious or are submitted by untrusted sources. Monitoring and restricting administrative actions related to form entry deletions can reduce risk. Check the vendor advisory for updates regarding patches or official remediation.