The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress (versions <=9.2.3) is vulnerable to arbitrary file deletion via a path traversal flaw (CWE-22). The delete_file() AJAX handler retrieves a file path from the database and passes it directly to the unlink() function without validation mechanisms like realpath(), basename(), or allowlist checks. The insert_record() AJAX handler permits authenticated users to store arbitrary values in the 'location' column, which is insufficiently sanitized by wp_kses(), allowing path traversal or absolute paths. This combination enables authenticated attackers with admin-level privileges or higher to delete arbitrary files on the server, including critical files such as wp-config.php. If the plugin's user-level option is configured differently, exploitation may be possible with lower privileges.

Successful exploitation allows an authenticated user with admin-level access or higher to delete arbitrary files on the affected WordPress server, potentially causing denial of service or loss of critical configuration files such as wp-config.php. This can disrupt website functionality and compromise site stability. The vulnerability does not directly disclose data or allow code execution but impacts integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to file deletion. Avoid using affected versions (<=9.2.3) in production environments if possible. Follow vendor updates for patches or official fixes.