CVE-2026-15450 is a path traversal vulnerability (CWE-22) in the Nex Forms – Ultimate Forms Plugin for WordPress. The delete_file() AJAX handler retrieves file paths from the database and passes them directly to the unlink() function without validation (no realpath(), basename(), or allowlist checks). The insert_record() AJAX handler allows authenticated users to store arbitrary values in the 'location' column, which is not properly sanitized against path traversal. This combination enables authenticated attackers with admin-level or potentially lower privileges (depending on user-level configuration) to delete arbitrary files on the server, including critical WordPress files like wp-config.php. The vulnerability is present in versions up to and including 9.2.3. No vendor advisory or patch is currently available.

An attacker with authenticated access (at least low privileges, admin-level or above) can delete arbitrary files on the affected server, potentially leading to denial of service or site compromise by removing critical files such as wp-config.php. This can disrupt website functionality and compromise site integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin access to trusted administrators only and monitor for suspicious activity related to file deletion. Avoid granting unnecessary privileges to users who can interact with the plugin's AJAX handlers.