Live › vulnerability › CVE-2026-111833
Go to dashboardweForms is a WordPress form-builder plugin by Bold Grid. A path traversal flaw lets a request reach files outside the directory the plugin intends to serve, per the NVD description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the weForms WordPress plugin at version 1.6.28 or earlier are in the stated range. The sources do not say which request path or setting is needed to reach the traversal, so whether a default install is exposed is unknown. Sites that do not run weForms can skip it.
No product ranges from the sources yet.
wp plugin get weforms --field=version1.6.28; anything at or below that is in the affected range per the description1.6.28 once the vendor publishes a fixed version; the sources do not name one, so unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
This page as .md · .json · in your agent: get_signal("CVE-2026-111833")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.