The Nex Forms – Ultimate Form Builder – Lite plugin contains a path traversal flaw in the delete_file() AJAX handler. The handler retrieves a file path from the database and passes it directly to unlink() without validation. Combined with the insert_record() handler that allows authenticated users to store arbitrary values in the 'location' column, this enables an attacker with admin-level or higher credentials to delete any file on the server, including critical files such as wp-config.php. The vulnerability arises from missing sanitization like no realpath(), basename(), or allowlist checks.

WordPress sites that have installed the Webaways NEX-Forms Ultimate Forms Plugin up to and including version 9.2.3. Administrators or higher privileged users of these sites are required to exploit the flaw. The issue is specific to the plugin and does not affect core WordPress or other plugins.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests that widespread exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, it is limited to trusted users, yet the impact—unrestricted deletion of arbitrary files—is severe. Attackers could remove configuration files, user data, or any files the server process can reach, potentially facilitating further compromise or site downtime.