Arbitrary file deletion in WordPress plugins

Arbitrary file deletion lets an attacker delete files on the server that the plugin should never touch.

Deleting the wrong file breaks the site, but the bigger risk is wp-config.php: if it is deleted, WordPress shows the install screen, and whoever gets there first can connect the site to their own database and take over.

What to do: update the plugin. Keep a recent off-site backup so you can restore files quickly.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Arbitrary file deletion records

118 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

high 8.1 FluentCart

Arbitrary file deletion

CVE-2026-120577 · affected 1.6.2 and older · fixed in 1.6.3 * · published 2026-11-03
high 7.5 Contact Form Extender for Divi

Arbitrary file deletion

CVE-2026-120559 · affected 1.0.6 and older · fixed in 1.0.7 * · published 2026-11-03
critical 9.1 BuddyPress XProfile Custom Image Field

Arbitrary file deletion

CVE-2026-120518 · affected 3.1.0 and older · fix not stated · published 2026-11-03
critical 9.8 Ultra Addons for Contact Form 7

Arbitrary file deletion

CVE-2026-102435 · affected 3.5.54 and older · fixed in 3.5.55 * · published 2026-11-02
critical 9.1 Acadlix LMS

Arbitrary file deletion

CVE-2026-103882 · affected 1.1.9 and older · fixed in 1.2.0 * · published 2026-10-31
medium 5.0 SureDash

Arbitrary file deletion

CVE-2026-115604 · affected 1.12.3 and older · fixed in 1.12.4 · published 2026-10-30
medium 4.9 JS Help Desk

Arbitrary file deletion

CVE-2026-104739 · affected 5.0.1 and older · fixed in 5.0.2 * · published 2026-10-30
high 8.1 Groundhogg

Arbitrary file deletion

CVE-2026-109221 · affected 4.9.3 and older · fixed in 4.9.4 * · published 2026-10-16
medium 5.3 Database Addon for Contact Form 7

Arbitrary file deletion

CVE-2026-107652 · affected 1.4.1 and older · fixed in 1.4.2 * · published 2026-10-14
medium 4.9 Listdom

Arbitrary file deletion

CVE-2026-104722 · affected 6.1.2 and older · fixed in 6.2.0 * · published 2026-10-10
critical 9.1 PPOM

Arbitrary file deletion

CVE-2026-104801 · affected 34.0.10 and older · fixed in 34.0.11 * · published 2026-10-10
high 8.6 Simple File List

Arbitrary file deletion

CVE-2026-39792 · affected 6.3.11 and older · fix not stated · published 2026-10-06
high 7.7 Job Postings

Arbitrary file deletion

CVE-2026-39752 · affected 2.8.2 and older · fixed in 2.8.3 * · published 2026-10-06
critical 9.1 VikAppointments Services Booking Calendar

Arbitrary file deletion

CVE-2026-87115 · affected 1.2.21 and older · fixed in 1.2.22 * · published 2026-10-03
high 8.6 AcyMailing

Arbitrary file deletion

CVE-2026-95588 · affected 11.0.5 and older · fixed in 11.1.0 · published 2026-10-01
medium 6.8 WEBO MCP

Arbitrary file deletion

CVE-2026-97242 · affected 3.0.18 and older · fixed in 3.0.22 · published 2026-09-30
medium 6.8 Template Kit

Arbitrary file deletion

CVE-2026-96824 · affected 1.0.16 and older · fixed in 1.0.17 · published 2026-09-30
high 8.1 Modula Image Gallery

Arbitrary file deletion

CVE-2026-92713 · affected 3.0.2 and older · fixed in 3.0.3 * · published 2026-09-25
medium 6.5 User Frontend

Arbitrary file deletion

CVE-2026-95525 · affected 4.3.11 and older · fixed in 4.3.12 · published 2026-09-23
high 8.1 UsersWP

Arbitrary file deletion

CVE-2026-19991 · affected 1.2.70 and older · fixed in 1.2.71 * · published 2026-09-11
high 8.1 Next-Cart Store to WooCommerce Migration

Arbitrary file deletion

CVE-2026-76009 · affected 3.9.8 and older · fixed in 3.9.9 * · published 2026-09-09
high 7.5 ACF Frontend Admin by DynamiApps

Arbitrary file deletion

CVE-2026-19952 · affected 3.29.12 and older · fixed in 3.29.13 * · published 2026-09-01
high 8.6 MasterStudy LMS WordPress Plugin

Arbitrary file deletion

CVE-2026-78284 · affected 3.7.42 and older · fixed in 3.7.43 · published 2026-08-24
high 8.1 Atarim

Arbitrary file deletion

CVE-2026-19942 · affected 5.1.1 and older · fixed in 5.1.2 * · published 2026-08-19
high 8.8 Podlove Podcast Publisher

Arbitrary file deletion

CVE-2026-16099 · affected 4.5.3 and older · fixed in 4.5.4 * · published 2026-08-16
critical 9.1 ProSolution WP Client

Arbitrary file deletion

CVE-2026-14524 · affected 2.0.8 and older · fixed in 2.0.18 * · published 2026-08-16
critical 9.1 Link Library

Arbitrary file deletion

CVE-2026-18855 · affected 7.9.4 and older · fixed in 7.9.5 * · published 2026-08-15
critical 9.1 RapiSafe

Arbitrary file deletion

CVE-2026-14484 · affected 1.0.4 and older · fix not stated · published 2026-08-15
high 7.4 Participants Database

Arbitrary file deletion

CVE-2026-28189 · affected 2.7.8.4 and older · fixed in 2.7.8.5 · published 2026-08-13
high 8.1 GeoDirectory

Arbitrary file deletion

CVE-2026-19091 · affected 2.8.169 and older · fixed in 2.8.170 * · published 2026-08-11
high 8.8 File Manager

Arbitrary file deletion

CVE-2026-15991 · affected 6.0 to 6.9 · fixed in 6.9.1 * · published 2026-08-06
high 8.1 Content Egg

Arbitrary file deletion

CVE-2026-15979 · affected 11.3.0 and older · fixed in 11.4.0 * · published 2026-08-05
high 8.1 NEX-Forms

Arbitrary file deletion

CVE-2026-15450 · affected 9.2.3 and older · fixed in 9.2.4 * · published 2026-08-01
critical 9.1 FormGent

Arbitrary file deletion

CVE-2026-3141 · affected 1.9.2 and older · fixed in 1.10.0 * · published 2026-08-01
high 7.2 Better Messages

Arbitrary file deletion

CVE-2026-16585 · affected 2.15.19 and older · fixed in 2.15.33 * · published 2026-07-28
medium 4.9 Easy Digital Downloads

Arbitrary file deletion

CVE-2026-66476 · affected 3.6.9 and older · fixed in 3.6.9.1 * · published 2026-07-27
medium 6.8 Kirki

Arbitrary file deletion

CVE-2026-65436 · affected 6.0.13 and older · fixed in 6.0.14 · published 2026-07-27
high 7.7 Kali Forms

Arbitrary file deletion

CVE-2026-59542 · affected 2.4.18 and older · fixed in 2.4.19 · published 2026-07-23
critical 10.0 Participants Database

Arbitrary file deletion

CVE-2026-59555 · affected 2.7.8.3 and older · fixed in 2.7.8.4 · published 2026-07-23
high 7.1 Picture Gallery

Arbitrary file deletion

CVE-2026-57696 · affected 1.6.5 and older · fixed in 1.6.6 · published 2026-07-23
medium 5.3 Broadcast Live Video

Arbitrary file deletion

CVE-2026-57716 · affected 7.2.4 and older · fixed in 7.2.5 · published 2026-07-23
high 8.1 Uncanny Automator

Arbitrary file deletion

CVE-2026-15008 · affected 7.3.1.4 and older · fixed in 7.3.2 * · published 2026-07-16
high 8.8 UsersWP

Arbitrary file deletion

CVE-2026-13492 · affected 1.2.65 and older · fixed in 1.2.66 * · published 2026-07-09
high 7.1 Bit Form

Arbitrary file deletion

CVE-2026-14372 · affected 3.1.1 and older · fixed in 3.1.2 * · published 2026-07-09
critical 9.1 Simple Coherent Form

Arbitrary file deletion

CVE-2026-14487 · affected 2.4.13 and older · fix not stated · published 2026-07-08
critical 9.1 Printcart Store

Arbitrary file deletion

CVE-2026-9725 · affected 2.5.2 and older · fixed in 2.5.3 * · published 2026-07-03
high 8.1 TinyPNG Image Optimization

Arbitrary file deletion

CVE-2026-7311 · affected 3.6.13 and older · fixed in 3.6.14 * · published 2026-07-02
high 8.1 Image Optimizer

Arbitrary file deletion

CVE-2026-5821 · affected 1.7.4 and older · fixed in 1.7.5 * · published 2026-07-02
critical 9.1 WP-BusinessDirectory

Arbitrary file deletion

CVE-2026-6070 · affected 4.0.1 and older · fix not stated · published 2026-07-01
high 8.0 Export User Data

Arbitrary file deletion

CVE-2026-12240 · affected 2.2.6 and older · fix not stated · published 2026-06-30
critical 9.9 Paid Videochat Turnkey Site

Arbitrary file deletion

CVE-2026-57331 · affected 7.4.8 and older · fixed in 7.4.9 · published 2026-06-29
high 8.1 Frontend File Manager Plugin

Arbitrary file deletion

CVE-2026-8095 · affected 23.6 and older · fix not stated · published 2026-06-28
high 7.1 Interactive Content

Arbitrary file deletion

CVE-2026-57321 · affected 1.17.7 and older · fixed in 1.17.8 · published 2026-06-26
medium 5.8 ShortPixel Adaptive Images

Arbitrary file deletion

CVE-2026-56066 · affected 3.11.4 and older · fixed in 3.11.5 · published 2026-06-26
high 7.7 JS Help Desk

Arbitrary file deletion

CVE-2026-56054 · affected 3.1.1 and older · fixed in 3.1.2 · published 2026-06-25
high 7.5 Simple File List

Arbitrary file deletion

CVE-2026-11911 · affected 6.3.7 and older · fix not stated · published 2026-06-20
high 8.1 Database for Contact Form 7, WPforms, Elemento…

Arbitrary file deletion

CVE-2026-9843 · affected 1.5.1 and older · fixed in 1.5.2 * · published 2026-06-20
critical 9.9 WP User Manager

Arbitrary file deletion

CVE-2026-49766 · affected 2.9.16 and older · fixed in 2.9.17 · published 2026-06-15
high 7.7 Link Library

Arbitrary file deletion

CVE-2026-40779 · affected 7.8.8 and older · fixed in 7.8.9 · published 2026-06-15
high 8.6 Contact Form Extender for Divi

Arbitrary file deletion

CVE-2026-40769 · affected 1.0.6 and older · fixed in 1.0.7 · published 2026-06-15
high 7.7 Groundhogg

Arbitrary file deletion

CVE-2026-40727 · affected 4.4 and older · fixed in 4.4.1 · published 2026-06-15
medium 6.8 Meta Box

Arbitrary file deletion

CVE-2026-39468 · affected 5.11.1 and older · fixed in 5.11.2 · published 2026-06-15
high 7.5 Kirki

Arbitrary file deletion

CVE-2026-8073 · affected 6.0.6 and older · fixed in 6.0.7 * · published 2026-05-19
high 8.1 Motors

Arbitrary file deletion

CVE-2026-3892 · affected 1.4.107 and older · fixed in 1.4.108 * · published 2026-05-14
high 8.1 WP-Optimize

Arbitrary file deletion

CVE-2026-7252 · affected 4.5.2 and older · fixed in 4.5.3 * · published 2026-05-07
high 8.1 wpForo Forum

Arbitrary file deletion

CVE-2026-6248 · affected 3.0.5 and older · fixed in 3.0.6 * · published 2026-04-20
high 7.1 wpForo Forum

Arbitrary file deletion

CVE-2026-5809 · affected 3.0.2 and older · fixed in 3.0.3 * · published 2026-04-11
high 8.8 Advanced Members for ACF

Arbitrary file deletion

CVE-2026-3243 · affected 1.2.5 and older · fixed in 1.2.6 * · published 2026-04-08
high 8.8 wpForo Forum

Arbitrary file deletion

CVE-2026-3666 · affected 2.4.16 and older · fixed in 2.4.17 * · published 2026-04-04
high 8.8 WP Job Portal

Arbitrary file deletion

CVE-2026-4758 · affected 2.4.9 and older · fixed in 2.5.0 * · published 2026-03-26
high 8.1 Invelity Product Feeds

Arbitrary file deletion

CVE-2025-14037 · affected 1.2.6 and older · fix not stated · published 2026-03-21
high 7.2 Meta Box

Arbitrary file deletion

CVE-2025-14675 · affected 5.11.1 and older · fixed in 5.11.2 * · published 2026-03-07
critical 9.8 Snow Monkey Forms

Arbitrary file deletion

CVE-2026-1056 · affected 12.0.3 and older · fixed in 12.0.4 * · published 2026-01-28
high 8.8 BuddyPress Xprofile Custom Field Types

Arbitrary file deletion

CVE-2025-14997 · affected 1.2.8 and older · fixed in 1.3.0 * · published 2026-01-06
critical 9.8 Multi Uploader for Gravity Forms

Arbitrary file deletion

CVE-2025-14344 · affected 1.1.7 and older · fixed in 1.1.10 * · published 2025-12-12
medium 6.8 WP User Manager

Arbitrary file deletion

CVE-2025-13320 · affected 2.9.12 and older · fixed in 2.9.13 * · published 2025-12-12
high 7.2 Modula Image Gallery

Arbitrary file deletion

CVE-2025-13645 · affected 2.13.1 to 2.13.2 · fixed in 2.13.3 * · published 2025-12-03
high 8.8 Cost Calculator Builder

Arbitrary file deletion

CVE-2025-12529 · affected 3.6.3 and older · fixed in 3.6.4 * · published 2025-12-02
high 8.1 WP AUDIO GALLERY

Arbitrary file deletion

CVE-2025-13322 · affected 2.0 and older · fix not stated · published 2025-11-21
medium 4.3 Modula Image Gallery

Arbitrary file deletion

CVE-2025-12494 · affected 2.12.28 and older · fixed in 2.12.29 * · published 2025-11-15
medium 6.5 Data Tables Generator by Supsystic

Arbitrary file deletion

CVE-2025-12089 · affected 1.10.45 and older · fixed in 1.10.46 * · published 2025-11-13
medium 6.5 CYAN Backup

Arbitrary file deletion

CVE-2025-12092 · affected 2.5.4 and older · fixed in 2.5.5 * · published 2025-11-08
medium 6.5 WPFunnels

Arbitrary file deletion

CVE-2025-12000 · affected 3.6.2 and older · fixed in 3.6.3 * · published 2025-11-08
critical 9.1 FormGent

Arbitrary file deletion

CVE-2025-10916 · affected older than 1.0.4 · fixed in 1.0.4 · published 2025-10-21
critical 9.8 WP Travel Engine

Arbitrary file deletion

CVE-2025-7526 · affected 6.6.7 and older · fixed in 6.6.8 * · published 2025-10-09
high 8.1 Motors

Arbitrary file deletion

CVE-2025-10494 · affected 1.4.89 and older · fixed in 1.4.90 * · published 2025-10-08
medium 6.5 Backuply

Arbitrary file deletion

CVE-2025-10307 · affected 1.4.8 and older · fixed in 1.4.9 * · published 2025-09-26
high 8.1 WP Ultimate CSV Importer

Arbitrary file deletion

CVE-2025-10058 · affected 7.27 and older · fixed in 7.28 * · published 2025-09-17
high 8.8 Redirection for Contact Form 7

Arbitrary file deletion

CVE-2025-8141 · affected 3.2.4 and older · fixed in 3.2.5 * · published 2025-08-20
medium 4.3 Media Library Assistant

Arbitrary file deletion

CVE-2025-8357 · affected 3.27 and older · fixed in 3.28 * · published 2025-08-19
high 8.1 Extensions For CF7 (Contact form 7 Database, C…

Arbitrary file deletion

CVE-2025-7645 · affected 3.2.8 and older · fixed in 3.2.9 * · published 2025-07-22
critical 9.8 HT Contact Form

Arbitrary file deletion

CVE-2025-7341 · affected 2.2.1 and older · fixed in 2.2.2 * · published 2025-07-15
high 8.1 SureForms

Arbitrary file deletion

CVE-2025-6691 · affected 0.0 to 0.0.13, 1.0 to 1.0.6, 1.1 to 1.1.1, 1.2 to 1.2.4, 1.3 to 1.3.1, 1.4 to 1.4.4, 1.5 only, 1.6 to 1.6.4, 1.7 to 1.7.3 · fixed in 1.7.4 * · published 2025-07-09
high 8.8 Forminator Forms

Arbitrary file deletion

CVE-2025-6463 · affected 1.44.2 and older · fixed in 1.44.3 * · published 2025-07-02
high 7.5 Everest Forms

Arbitrary file deletion

CVE-2025-5927 · affected older than 1.9.5 · fixed in 1.9.5 · published 2025-06-25
high 7.2 WP-DownloadManager

Arbitrary file deletion

CVE-2025-4799 · affected 1.68.10 and older · fixed in 1.68.11 * · published 2025-06-11
critical 9.1 eMagicOne Store Manager for WooCommerce

Arbitrary file deletion

CVE-2025-4603 · affected 1.2.5 and older · fixed in 1.3.0 * · published 2025-05-24
high 7.2 Groundhogg

Arbitrary file deletion

CVE-2025-4206 · affected 4.1.1.2 and older · fixed in 4.1.2 * · published 2025-05-09
high 8.8 Download Manager

Arbitrary file deletion

CVE-2025-3404 · affected 3.3.12 and older · fixed in 3.3.13 * · published 2025-04-19
high 8.1 WP Ultimate CSV Importer

Arbitrary file deletion

CVE-2025-2007 · affected 7.19 and older, 7.20 only · fixed in 7.20.1 * · published 2025-04-01

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan