# WeForms <= 1.6.28 - Unauthenticated Insecure Direct Object Reference to Arbitrary Attachment Deletion via Upload Field Values

- **ID:** WPSEC-2026-1203
- **Plugin:** weForms – Easy Drag & Drop Contact Form Builder For WordPress (`weforms`), https://wordpress.org/plugins/weforms/
- **Affected versions:** from 1.3.5 before 1.6.29
- **Fixed in:** 1.6.29 (Update to 1.6.29 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/weforms
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1203/

## Description

The weForms plugin for WordPress is vulnerable to Insecure Direct Object Reference via the image and file upload field values of a front-end form submission in all versions up to, and including, 1.6.28, due to missing validation on a user controlled key. Attachment IDs submitted in an upload field are saved with the entry without checking that the submitter uploaded them, and every stored ID is force-deleted when the entry is permanently deleted. This makes it possible for unauthenticated attackers to add any media library attachment to a form entry. That attachment and its file are permanently deleted when an administrator permanently deletes the entry.

## References

- https://wpsec.com/vuln/WPSEC-2026-1203/
- https://plugins.svn.wordpress.org/weforms/tags/1.6.29/
- https://wordpress.org/plugins/weforms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1203/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.