MEDIUM 6.5 NVD

CVE-2026-15382

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-upload

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.

References

https://wpscan.com/vulnerability/54e94f13-758d-4e05-9993-c72ea270e216/

Published: 2026-07-30 · Source: NVD · Feed updated: 2026-08-04

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-07-30 via NVD.

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.