{"id":"CVE-2026-111833","kind":"vulnerability","aliases":["CVE-2026-111833"],"related":[],"title":"weForms WordPress plugin: path traversal through versions up to 1.6.28","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.","summary":"weForms is a WordPress form-builder plugin by Bold Grid. A path traversal flaw lets a request reach files outside the directory the plugin intends to serve, per the NVD description.","severity":"high","cvss":7.5,"epss":0.00479,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","weforms","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed weForms version in the WordPress admin plugin list or with `wp plugin get weforms --field=version`\n- Compare the result against `1.6.28`; anything at or below that is in the affected range per the description","fix":"- Update weForms to a release newer than `1.6.28` once the vendor publishes a fixed version; the sources do not name one, so unknown\n- Restrict access to the site's form endpoints at the web server until patched if a fixed version is not yet available","status":"open","published_at":"2026-10-21T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:47+00:00","updated_at":"2026-10-25T03:16:47+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:16:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update weForms to a release newer than `1.6.28` once the vendor publishes a fixed version; the sources do not name one, so unknown\n- Restrict access to the site's form endpoints at the web server until patched if a fixed version is not yet available","reach":"internet","title":"weForms WordPress plugin: path traversal through versions up to 1.6.28","impact":"medium","summary":"weForms is a WordPress form-builder plugin by Bold Grid. A path traversal flaw lets a request reach files outside the directory the plugin intends to serve, per the NVD description.","category":"package","nicknames":[],"who_cares":["wordpress","weforms"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads server files outside the intended plugin directory","analyst_note":"Find the vulnerable endpoint, required privilege, and the fixed version from the NVD entry and Bold Grid's changelog; the sources give only a version range.","how_to_check":"- Check the installed weForms version in the WordPress admin plugin list or with `wp plugin get weforms --field=version`\n- Compare the result against `1.6.28`; anything at or below that is in the affected range per the description","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the weForms WordPress plugin at version 1.6.28 or earlier are in the stated range. The sources do not say which request path or setting is needed to reach the traversal, so whether a default install is exposed is unknown. Sites that do not run weForms can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":3345,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111833':13A,16A '-2026':12A,15A '1.6.28':10A,78C 'affect':73C 'allow':69C 'bold':29B,65C 'builder':26B 'cve':11A,14A 'descript':51B 'directori':42B,60C 'file':39B 'flaw':34B 'form':25B 'form-build':24B 'grid':30B,66C 'improp':52C 'intend':45B 'issu':72C 'let':35B 'limit':53C 'n/a':76C 'nvd':50B 'outsid':40B 'packag':17B 'path':4A,32B,61C,70C 'pathnam':56C 'per':48B 'plugin':3A,27B,44B 'reach':38B 'request':37B 'restrict':59C 'serv':47B 'travers':5A,33B,62C 'traversal.this':71C 'version':7A 'vulner':63C 'weform':1A,18B,20B,67C,68C,74C 'wordpress':2A,19B,23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the weForms WordPress plugin at version 1.6.28 or earlier are in the stated range. The sources do not say which request path or setting is needed to reach the traversal, so whether a default install is exposed is unknown. Sites that do not run weForms can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111833","severity":null,"published_at":"2026-10-21T15:17:15+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111833","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111833","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}