Ultimate Addons for WPBakery Page Builder < 3.21.4 – Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts | CVE 2026-15382

Description

The plugin does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.

Proof of Concept

Prerequisites:
- Ultimate Addons for WPBakery Page Builder <= 3.21.3 installed and activated, with WPBakery Page Builder (js_composer) active.
- At least one custom icon font pack uploaded by an administrator via WP Admin > Ultimate Addons > Icon Manager.

Steps (no authentication, no cookies, no nonce):

1. As an unauthenticated visitor, send a single GET request to any page of the site:

   curl "https://victim.example/?delete-bsf-fonts=1"

Expected result:
- Every custom-uploaded icon font pack is recursively deleted from the uploads font directory, and the smile_fonts option is reset to the plugin's bundled 'Defaults' entry only.
- The custom fonts are gone from disk and are not recoverable without re-uploading; front-end pages that used them lose their icons.