CVE-2026-9843— Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

对路径名的限制不恰当(路径遍历)

crmperks Database for Contact Form 7, WPforms, Elementor forms 路径遍历漏洞

crmperks database for contact form 7, wpforms, elementor forms是crmperks个人开发者开源的一个表单数据库管理插件。 crmperks Database for Contact Form 7, WPforms, Elementor forms 1.5.1及之前版本存在路径遍历漏洞，该漏洞源于view_page函数中文件路径验证不足，可能导致未经身份验证的攻击者删除任意文件，进而可能导致远程代码执行。

N/A

N/A