The weForms plugin contains a path‑validation flaw in the weforms_delete_entry_attachments function. When an administrator deletes a form entry, unauthenticated attackers can supply a crafted wpuf_files parameter that bypasses file path checks, allowing the deletion of arbitrary media files on the server. This results in loss of content and can be used to mount social‑engineering attacks that prompt admins to delete spam‑like entries, thereby facilitating the exploitation. The weakness is an instance of CWE‑22 path traversal, compromising file system integrity and the availability of media resources.

WordPress sites that run the weForms – Easy Drag & Drop Contact Form Builder plugin on any version up to and including 1.6.28 are affected. The vulnerable code resides in the class-ajax.php file and is triggered during the standard administrative moderation action of deleting a form entry. Any site utilizing this plugin without upgrading beyond the specified version exposes its media library to arbitrary deletion.

The CVSS score of 5.4 indicates moderate risk, while the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to entice a site administrator into deleting a poisoned entry, which is an untrusted, non‑authenticated action that can occur via web interface. Once an admin performs the deletion, the flaw allows removal of any media file on the server, resulting in potential data loss and service disruption.