Contact Form Extender CVE-2026-120559

Requires the Contact Form Extender for Divi Builder plugin to be installed and active at version ≤1.0.6, with a form/file-upload module rendered on a publicly reachable page so that the wp_localize_script-embedded nonce for the AJAX action is present in the page source. Given that, there are no further special conditions - exploitation is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N) because the nonce, the only gate on cfefd_remove_uploaded_file(), is retrievable by any anonymous visitor and the file path is insufficiently validated (CWE-22). The practical limiting factors are therefore solely the plugin's presence/version and the public exposure of a page that emits the nonce; no operator authentication or non-default setting is needed.

The signals point to a genuinely dangerous but not yet actively-exploited flaw whose real-world urgency is bounded by product footprint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case attackability profile: remote, network-reachable, low-complexity, no privileges (PR:N = unauthenticated) and no user interaction, which maps to an SSVC 'automatable: yes' / high-technical-impact case since arbitrary file deletion of wp-config.php yields site takeover/RCE. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with the absence of KEV listing and the lack of any EPSS score in the supplied data. No public exploit code is present in the references (they are a Wordfence advisory plus WordPress.org source-tree/changeset links, not a working PoC). One data discrepancy to flag explicitly: the supplied CVSS vector scores C:H/I:N/A:N, yet the described mechanism is arbitrary file DELETION, whose direct impact is integrity/availability, not confidentiality - the C:H almost certainly encodes the downstream RCE/full-compromise path rather than a direct information-disclosure primitive; verify scoring intent with Wordfence. Net: for any site actually running this plugin at ≤1.0.6 this is a high-priority, trivially-reachable issue, but the low deployment footprint of a Divi-specific add-on keeps aggregate/wormable risk below that of a ubiquitous component.

An unauthenticated attacker loads a public page that renders the plugin's Divi file-upload module, reads the AJAX nonce that wp_localize_script embeds directly in the page source, and then issues a crafted request to the cfefd_remove_uploaded_file() action supplying a path-traversal filename. By deleting wp-config.php (or another critical file) they can force WordPress into its setup/reinstall state and pivot to remote code execution. No authentication, user interaction, or special configuration beyond the vulnerable plugin being active is required; no public exploit identified at time of analysis.