The NEX-Forms WordPress plugin is affected by a path traversal vulnerability that could allow an authenticated attacker to delete sensitive files on the host server.

This is a path traversal vulnerability that allows an authenticated user with sufficient permissions to manipulate file paths and delete files outside of the intended directory. The flaw resides within the plugin's file handling functions.

Successful exploitation leads to the deletion of critical system or application files, resulting in potential service denial or data loss. With a CVSS score of 8.1, the risk is high, particularly if the attacker gains access to files essential for site stability or security. This could lead to prolonged downtime and recovery costs for the affected organization.

Immediate Action: Update the NEX-Forms plugin to the latest version immediately. If an update is not available, remove the plugin from the environment.

Proactive Monitoring: Monitor file integrity and access logs for unusual deletion requests or attempts to access directories outside of the web root.

Compensating Controls: Use a Web Application Firewall (WAF) with path traversal detection rules to block malicious requests attempting to manipulate file paths.

Public Exploit Available: No

Administrators must treat this vulnerability with urgency due to the risk of permanent data loss or system instability. Patching the plugin is the primary remediation step; if a patch is not immediately available, disabling the plugin is recommended to prevent exploitation.