Vulnerabilities / WeForms
WeForms vulnerabilities
Advisories WPSec published for weForms – Easy Drag & Drop Contact Form Builder For WordPress. Other sources may list more. Its attack surface: WeForms on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-17 | WPSEC-2026-1203 | WeForms <= 1.6.28 - Unauthenticated Insecure Direct Object Reference to Arbitrary Attachment Deletion via Upload Field Values | Medium 5.4 | 1.6.29 |
License: CC BY 4.0