Description
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
webaways NEX-Forms – Ultimate Forms Plugin for WordPress
Default version status: unaffected
0 to ≤ 9.2.3affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5c8cb3-df67-4f2c-869a-48e34f5619ff?source=cve ↗
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.db.php#L805 ↗
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.db.php#L269 ↗
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.db.php#L273 ↗
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3625615%40nex-forms-express-wp-form-builder&new=3625615%40nex-forms-express-wp-form-builder ↗